Malicious PDF — malware analysis report

Static analysis result for SHA-256 25c0ce0fa9ee5caa…

MALICIOUS

PDF

87.1 KB Created: 2021-06-26 03:14:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 2045a234cedcd87f8dd67a73e8b2a53a SHA-1: 3384eee6f444f3353f24053e0b4d26709132abc1 SHA-256: 25c0ce0fa9ee5caa069eb41155cf463684d259837fcd07b0df67db5fc3a1a31b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF was flagged by a machine learning classifier and ClamAV as malicious, indicating a phishing or trojan threat. It contains embedded URLs that likely lead to malicious sites, attempting to trick the user into downloading further malware or submitting credentials. The presence of PDF_URI and EMBEDDED_URL heuristics further supports this phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9835

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.pferde-fuer-unsere-kinder.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607c7a36bfc75---73868668559.pdf
    • http://thanhlamresort.vn/wp-content/plugins/formcraft/file-upload/server/content/files/1608cb921a55b6---sititebeto.pdf
    • http://novussiteyonetimi.com/uploads/file/bajumidatetukomanazixi.pdf
    • http://feast.to/upd_file/guruzokubedupedanafe.pdf
    • http://actionelectric.pt/www/wp-content/plugins/formcraft/file-upload/server/content/files/16072f275472bc---majogewowujukasug.pdf
    • https://www.mybizwebsites.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a8a21c23e0d---nasugemobewudazexavudon.pdf
    • https://www.waterlooarmsnewforest.co.uk/wp-content/plugins/super-forms/uploads/php/files/9186299c577b6c8d59a4d5591e82bc66/pigoridiwawanimosivoxuzo.pdf
    • https://sidexsideaudio.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d2cf7901a1---fozafozux.pdf
    • https://luxmarketing.agency/wp-content/plugins/super-forms/uploads/php/files/n8aj8mqb2v4h0vin28as2mfdt8/12152644264.pdf
    • https://completecollegestrategies.com/wp-content/plugins/super-forms/uploads/php/files/116d30aaa1d0a9742400b4681532a14a/reratagotiziwo.pdf
    • https://www.hinogas.com/wp-content/plugins/super-forms/uploads/php/files/qrj2n6sd5e714q8hcejv219d94/wupapagofogotumaxi.pdf
    • http://global-gypsum.com/wp-content/plugins/formcraft/file-upload/server/content/files/160753b25ec652---wonarozo.pdf
    • http://bukharaalpharetta.com/sites/default/files/file/mifogigajopeledamodage.pdf
    • http://cascinamana.it/userfiles/file/favepozebenubibadanemuma.pdf
    • https://dtcprojects.com.au/wp-content/plugins/super-forms/uploads/php/files/8ahesvrme9kss008aftbm95qis/xunipipinagujoje.pdf
    • https://alenakovalchuk.ru/wp-content/plugins/super-forms/uploads/php/files/e8266815eec0ec374c0c22aba9af2c63/25038795499.pdf
    • http://rusiuojigalvoji.lt/wp-content/plugins/formcraft/file-upload/server/content/files/1607656aaed84c---95584809931.pdf
    • http://aisef.org/uploads/userfiles/file/file/11439131458.pdf
    • http://raduzhniy.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bbe435118bc---dutodirakavuwuzosade.pdf
    • http://pocatellocampfire.com/wp-content/plugins/super-forms/uploads/php/files/n3erh363lq3dj2m1v8kn5f982f/nirazoteziwesasumanag.pdf
    • https://caribemed.com/userfiles/file/60130520843.pdf
    • http://fitnessklub-impuls.pl/uploads/assets/file/limojesewofijujukagoruvon.pdf
    • http://orgue-chantepie.info/FCKeditor/upload/file/jaganirusufizi.pdf
    • https://stillwaiting.org/userfiles/file/17423263038.pdf
    • https://nationalcardsolutions.com/wp-content/plugins/formcraft/file-upload/server/content/files/16089f91482b19---77843869469.pdf
    • http://www.petersmetalstitching.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/16098c7f54ea00---laladukifanojozus.pdf
    • https://feedproxy.google.com/~r/skout/mBVl/~3/LPIa9PGmDLg/uplcv?utm_term=ap+environmental+science+practice+test+answers
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed7c.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED7C 16792 bytes
font_01_sfnt_off0001058e.bin
0ce2654b93e47f5b83118f7c8308688b6e102358f34c749f393714efaf61b949		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1058E 18428 bytes
font_02_sfnt_off0001361b.bin
25f48bc489bfc80755a6d75eb3cc0840dcea300f11d6e13c9c57638c52900d38		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1361B 10668 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.