Malicious PDF — malware analysis report

Static analysis result for SHA-256 28458f9a2159f616…

MALICIOUS

PDF

74.8 KB Created: 2021-06-01 05:43:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: eaadf07a087371f33af13f03693ef3ec SHA-1: c8c952f89be61addf6ea7459f81fdb0b5597a103 SHA-256: 28458f9a2159f616baf0e8e9c6417e4c42e49b04ee2ceca4f31bd71976b9c07f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URL that, when accessed, likely leads to a phishing attempt or further malware download. The document body, though heavily obfuscated, appears to be a lure related to a sewing machine manual.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://archism.ru/pbw?utm_term=dressmaker+sewing+machine+manual+pdf
    • https://cdn-cms.f-static.net/uploads/4503987/normal_60591f6deafdd.pdf
    • https://cdn-cms.f-static.net/uploads/4467300/normal_6011edbe23519.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://venatulafiz.pbworks.com/f/temple_tiger_and_more_man-eaters_of_kumaon.pdf
    • http://xofitesu.pbworks.com/f/gaxubuwirezusa.pdf
    • https://uploads.strikinglycdn.com/files/194fb884-dcdf-4f60-a660-88971f183f57/titanic_movie_free_download_in_tamil_hd_1080p.pdf
    • https://uploads.strikinglycdn.com/files/8d3512a1-e4d2-47f0-aae4-3b7fd2cdd7ad/97129340158.pdf
    • https://uploads.strikinglycdn.com/files/ab2f82ba-5d96-422e-b157-6a080f922a1d/dell_optiplex_9020_sff_compatible_graphics_card.pdf
    • https://uploads.strikinglycdn.com/files/ef5a1284-80c9-4ff1-806b-198e5a073506/saaho_full_movie_download_filmywap_hindi.pdf
    • http://kokoxudalux.pbworks.com/w/file/fetch/144427746/what_personality_type_is_most_compatible_with_intp.pdf
    • https://uploads.strikinglycdn.com/files/cc82cb5c-0743-4573-80ed-1f55af1c7ff6/segarobef.pdf
    • https://uploads.strikinglycdn.com/files/482d402f-3984-4f89-9219-963da78bfbd8/how_to_describe_your_philosophy_of_education_examples.pdf
    • http://viluxese.pbworks.com/f/47179590125.pdf
    • http://mapijakemifo.pbworks.com/f/wejulirerini.pdf
    • http://jesababa.pbworks.com/w/file/fetch/144413976/75834922639.pdf
    • https://uploads.strikinglycdn.com/files/cf86878c-a396-4b05-beb8-ab4f659dfd67/72148912405.pdf
    • https://uploads.strikinglycdn.com/files/05fe5a0f-707d-4ce9-ab9c-686b4cdfc3f0/what_does_yo_te_amo_demasiado_mean_in_english.pdf
    • https://uploads.strikinglycdn.com/files/18c750d0-fa9c-4a53-9744-2c7fee2d8c16/preo_do_livro_um_compromisso_por_dia.pdf
    • http://jesababa.pbworks.com/f/52294456850.pdf
    • https://uploads.strikinglycdn.com/files/e4d657a5-2d47-4cc6-8139-991d43dd4886/how_to_trade_cryptocurrency.pdf
    • http://xuruzinijub.pbworks.com/f/how_many_red_ace.pdf
    • http://nusuwoxub.pbworks.com/w/file/fetch/144413496/razonamiento_logico_matematico_santillana.pdf
    • https://uploads.strikinglycdn.com/files/cce7302d-51a4-4bae-ac20-dd315a148176/how_long_to_cook_a_roast_in_a_roaster_oven.pdf
    • http://lekipirunezi.pbworks.com/f/ipcc_standards_on_auditing_short_notes.pdf
    • https://uploads.strikinglycdn.com/files/d98f2a93-73da-43af-87c1-e538c1fdaee0/29752992692.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e391.bin
48b7e1c6b0de8111eb6537b3ca4c752f783f14801b4d0623644d0a25bb635885		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE391 5724 bytes
font_01_sfnt_off0000f707.bin
d4814a42def09dc03a6cafab6156f7af75aa555e59c98e3f77baf422d7c001fe		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF707 10880 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.