Malicious PDF — malware analysis report

Static analysis result for SHA-256 2711c86b039ab6b7…

MALICIOUS

PDF

205.9 KB Created: 2021-03-19 23:45:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 7c9731148dd7ed9c14dd119fc058c65b SHA-1: 99772d6f68328f697fe79b8532215a2354abfdba SHA-256: 2711c86b039ab6b735b579b045ec39990a9f881c2b386a8ed361fb7366d80529
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9834

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=kublai+khan+meaning PDF link annotation
    • http://verification-help.com/class_11_political_science_book_download_in_hindi9vpad.pdfIn PDF document text
    • https://cdn.sqhk.co/gibuburi/50CFfji/launcher_for_android_car_stereo.pdfIn PDF document text
    • http://tixshopclub.space/26907399244j78fe.pdfIn PDF document text
    • https://cdn.sqhk.co/demarumiju/ih0hbTq/44936136073.pdfIn PDF document text
    • http://pearhaidhr.fun/hack_game_jurassic_dino_water_world_apk4d825.pdfIn PDF document text
    • http://vuvuga.xyz/trevor_noah_born_a_crime_review0opqa.pdfIn PDF document text
    • https://cdn.sqhk.co/rasepotobami/mhbbigY/11340220940.pdfIn PDF document text
    • https://cdn.sqhk.co/jawuraxexije/Jhegeie/wosodotif.pdfIn PDF document text
    • http://help-bluebadgecenter.com/garmin_gns_650_xikwsww.pdfIn PDF document text
    • https://cdn.sqhk.co/fogizotufijo/1iehjia/11166447825.pdfIn PDF document text
    • https://cdn.sqhk.co/bisuligiga/gfhbhhh/american_speedway_motorcycle_racing.pdfIn PDF document text
    • http://italiahot.space/pimitotunemagutox1c364.pdfIn PDF document text
    • http://copyrightsafetyhelps.com/mivegutovetezogivawosokep23pa7.pdfIn PDF document text
    • http://logmeinnow.xyz/dietoterapia_de_krause_13_edicion_gratisk2ran.pdfIn PDF document text
    • https://cdn.sqhk.co/bopesajan/6igekhd/spinach_dip_recipe_without_cream_cheese.pdfIn PDF document text
    • http://snatural.space/house_music_beat_maker_freenwlw3.pdfIn PDF document text
    • https://cdn.sqhk.co/sovanoniwuva/eHZWOhc/marathon_race_time_calculator.pdfIn PDF document text
    • http://newyearshop.site/11782455897t6jqb.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://aa5f33e9-793b-4807-a257-9eac84d314d0.filesusr.com/ugd/aa57b2_d27d5d9a2efa4913b558cf6716623abc.pdf?index=trueIn PDF document text
    • https://367e539a-c541-4439-991c-4bf2bef2aa7a.filesusr.com/ugd/77d535_aa6adfc9fd6b405daddfd6d819c50ae0.pdf?index=trueIn PDF document text
    • https://e924225a-aa46-4bfc-8e56-7341551e1833.filesusr.com/ugd/54dfea_2b40fa9fd7d14db2bd988abb557589e8.pdf?index=trueIn PDF document text
    • https://b5b764bc-4fc6-48d7-9a4b-423a4d05f225.filesusr.com/ugd/3f2390_6a828ae5dcf94cfba1aa026ee863f202.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00020971.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x20971 66976 bytes
SHA-256: 11a67a740f0e96f806842227641bce739b0171bbaac80541b05a1f545be6b350
font_01_sfnt_off0002d17e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2D17E 4692 bytes
SHA-256: 909b8efa05feb26b891f25ba073b448d0c2867e78cac439fd2efbf80f2374e0d
font_02_sfnt_off0002e12e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2E12E 23828 bytes
SHA-256: 5289fd93e1a92dcf1e445e5c6c3309734c6b293873cbb8f2227ecf6bd74b4a5b
font_03_sfnt_off00031c6e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x31C6E 4324 bytes
SHA-256: 7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71

Open this report in the interactive analyzer, or submit your own file for analysis.