Malicious PDF — malware analysis report

Static analysis result for SHA-256 2791fac8c485a024…

MALICIOUS

PDF

81.2 KB Created: 2021-03-15 11:50:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5561d81f2892a1c3ba8e3f1fc49380d6 SHA-1: 272874c49a42525dd3030d6970f2e531ecf79275 SHA-256: 2791fac8c485a02442b2958fd1e4907c7c7060f46e82688819049a1b14abd60a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf and includes a URL that appears to be a lure for a phishing or malware distribution campaign. The presence of embedded URLs and the overall structure strongly suggest it's designed to trick users into visiting a malicious site, likely for credential harvesting or further payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=escabiosis+en+perros+tratamiento+pdf
    • https://cdn-cms.f-static.net/uploads/4408475/normal_5fe776e1d6e9c.pdf
    • http://fusegufuw.iblogger.org/how_to_make_your_own_chicken_feed_for_layers.pdf
    • https://static.s123-cdn-static.com/uploads/4478926/normal_5fcd694443906.pdf
    • https://cdn.sqhk.co/fizuborugas/icXghf7/volegutuxipolekiw.pdf
    • https://cdn-cms.f-static.net/uploads/4409107/normal_60150ddc82a2d.pdf
    • https://cdn-cms.f-static.net/uploads/4481065/normal_603a17fc390bb.pdf
    • http://derixen.22web.org/bind_model_to_form_angular_2.pdf
    • https://static.s123-cdn-static.com/uploads/4372719/normal_5fce528c6b803.pdf
    • https://static.s123-cdn-static.com/uploads/4377931/normal_5ffd3f15a7d68.pdf
    • https://cdn-cms.f-static.net/uploads/4446017/normal_604ed377b16da.pdf
    • https://cdn.sqhk.co/diratukuz/ibOjfha/89015888887.pdf
    • https://static.s123-cdn-static.com/uploads/4446270/normal_5ffd619bd03fb.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/6cd723df-e49b-488a-834d-8e6c655f9218/nugopax.pdf
    • https://ebba3e40-d49f-4cc8-b137-373bb1124918.filesusr.com/ugd/384ea4_ec164dfccdeb49bd8786cd2116cf884d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e20c08ed-1270-4cc8-83b4-9fd490ebc5bc/41870036744.pdf
    • https://uploads.strikinglycdn.com/files/2d840a69-b687-45ea-ac70-70fc514a24a0/cisco_ccna_200-301_exam_topics.pdf
    • https://61069a5e-3c5f-4884-a3c7-8c7552058b74.filesusr.com/ugd/0789d5_742ca3e16034433eabf136c90c1c6e06.pdf?index=true
    • https://334e481f-4595-4613-8514-cf1b68b0f675.filesusr.com/ugd/a5bb32_8643e1b2957a4a98998e336fa0cd0bd6.pdf?index=true
    • https://4f0754e2-f0c4-47db-826b-83042027646c.filesusr.com/ugd/7a11b0_9914dd73ec0f4ad98b291c02f609ef51.pdf?index=true
    • https://156bb51f-0b62-477f-88ca-8620af00812b.filesusr.com/ugd/e3ff21_a423afb3d7b44366b3161f11ca7ce1ef.pdf?index=true
    • https://uploads.strikinglycdn.com/files/bf859277-0391-4ce9-9a64-88e837e2c0d3/narcissus_and_goldmund_2020_online.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fe8e.bin
786e92a2e8048d419f3881c74c582194b3105da720f23071c5cefe9ed7e912e8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE8E 5364 bytes
font_01_sfnt_off000110b5.bin
0013d12b37b40dd3d54239ac087b75a13f6140cf7fae921e7744130f24b154d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x110B5 11608 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.