Malicious PDF — malware analysis report

Static analysis result for SHA-256 279a0ada47e906ed…

MALICIOUS

PDF

206.5 KB Created: 2021-03-03 18:30:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 0218d43df41fa5dc3a4fe15808435e23 SHA-1: 11930bf84242eae53d49133144ab0a1fd0a2f71b SHA-256: 279a0ada47e906ed1320a44788a37d5945744a80704280ace6d8d1dd66bf585d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9948

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/123?utm_term=is+the+wii+u+a+good+console PDF link annotation
    • http://joxitikoki.getenjoyment.net/charles_by_shirley_jackson_setting.pdfIn PDF document text
    • http://torevifij.iblogger.org/load_cell_amplifier_hx711_datasheet.pdfIn PDF document text
    • https://cdn.sqhk.co/xafeperale/hjVWjgT/rademesekogetuvonugiguz.pdfIn PDF document text
    • https://cdn.sqhk.co/gabogivoxavi/pTjctn2/wopiwovijasid.pdfIn PDF document text
    • http://kadazid.22web.org/tipij.pdfIn PDF document text
    • http://puwufonizezez.22web.org/rational_male_religion_audible.pdfIn PDF document text
    • https://cdn.sqhk.co/nuzitomizaj/w2jcAvE/pac_man_fever_game_soundtrack.pdfIn PDF document text
    • http://kaxavetaxudu.mywebcommunity.org/mowefibewo.pdfIn PDF document text
    • https://cdn.sqhk.co/tazurusubiz/fRhigj5/72421692095.pdfIn PDF document text
    • https://cdn.sqhk.co/jawutuwek/Wjdifjh/ridutilegeworumukivareze.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://nopawalaxuwaw.onlinewebshop.net/74932523766.pdfIn PDF document text
    • http://zivumimilalak.rf.gd/34901410344.pdfIn PDF document text
    • http://mudivufovibu.epizy.com/gavukewonevibibe.pdfIn PDF document text
    • http://firixafuzive.rf.gd/what_does_the_woe_mean.pdfIn PDF document text
    • http://segoxegigo.epizy.com/publishing_agreement_template_music.pdfIn PDF document text
    • http://fokelele.epizy.com/how_to_clean_the_dr_brown_sterilizer.pdfIn PDF document text
    • http://tididesonorevo.rf.gd/velonelidebewewuferivasi.pdfIn PDF document text
    • http://punolubumima.epizy.com/best_action_adventure_game_android.pdfIn PDF document text
    • http://puwagof.rf.gd/how_to_prime_diesel_injection_pump.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00029955.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x29955 20196 bytes
SHA-256: c236a2234360ff3db35b788442b2db6554d6bd5e26aaad09ac8d9c70cecb337b
font_01_sfnt_off0002d9b9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2D9B9 5136 bytes
SHA-256: fc62a599d0312b7b960e32e462b0468e876a2862246c4b884b4c6199f00f4cb3
font_02_sfnt_off0002eb46.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2EB46 12620 bytes
SHA-256: cd81eeadd5945f4691822d16f8e72fae2d65bfac062bb94339d2cdb30b1b62a8
font_03_sfnt_off00031531.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x31531 16608 bytes
SHA-256: 060c09449d3553e3f1afc6d79bc44a85261674f8fcae15532a0327a7070c0bc1

Open this report in the interactive analyzer, or submit your own file for analysis.