Malicious PDF — malware analysis report

Static analysis result for SHA-256 2c69890bf9430c42…

MALICIOUS

PDF

204.0 KB Created: 2021-05-01 05:48:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 2a37f0014a42441d8bca9a300879c06f SHA-1: 19f52404b16e2bde078ab4b7d0be6ea9fa79704a SHA-256: 2c69890bf9430c429b281e7e5e900f4004a19e6775994ab3a9751afea56db1b8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, likely for phishing purposes. The document body, though truncated and containing non-readable characters, suggests a lure related to 'arras del espíritu santo', which could be part of a social engineering tactic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9959

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=que+son+las+arras+del+esp%25C3%25ADritu+santo PDF link annotation
    • http://wofotejijuwulap.iblogger.org/conair_clipper_guard_size_chart.pdfIn PDF document text
    • http://cucoupon.info/invicta_watches_for_sale_cheap8rj40.pdfIn PDF document text
    • http://nyvelsets.online/ketamewubedagadogiley5ryi.pdfIn PDF document text
    • http://bnatural.space/percy_jackson_3_trailermmfy5.pdfIn PDF document text
    • http://tizorudaredan.iblogger.org/seepage_control_methods.pdfIn PDF document text
    • http://parkingtest.xyz/jowote37esn.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://5090cb7a-f7dd-45b7-a4a3-960150b62b23.filesusr.com/ugd/dfd4af_5ea36fad59c842f38f7d1c6866092617.pdf?index=trueIn PDF document text
    • https://2acf176d-1645-44e4-83be-c67f7ac9af6b.filesusr.com/ugd/e72dd6_6e403e400b044f4b9048b471a5033985.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/rebesudanolo/67976587597.pdfIn PDF document text
    • https://9cf5cc10-3c2e-4e30-ae6b-73ed7beed88a.filesusr.com/ugd/5c2b46_9598761fc83b46e0ba2e1c5212ee6499.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/werowibovezoje/graco_pack_n_play_instructions_disassembly.pdfIn PDF document text
    • http://demajipo.rf.gd/89182386341.pdfIn PDF document text
    • http://naditoliwinudev.epizy.com/relational_database_interview_questions_and_answers.pdfIn PDF document text
    • https://c7972686-9310-4d97-8ac3-15e828887225.filesusr.com/ugd/8a419d_c87ba9f332b44059be4a2661c92296a7.pdf?index=trueIn PDF document text
    • https://1df32be7-5e6a-491e-80e4-5c558052ef26.filesusr.com/ugd/e02e08_cbee593c3ad54904aa04ffa484fcad80.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/doxifuba/87553305551.pdfIn PDF document text
    • http://dukivudote.epizy.com/34042300319.pdfIn PDF document text
    • https://dd907c4b-492b-4b4d-bf3c-9f0b7a2bd2c7.filesusr.com/ugd/96a426_22cfc796aec04816a3bbe2c2447df0bd.pdf?index=trueIn PDF document text
    • http://sudezubedafa.epizy.com/99986545540.pdfIn PDF document text
    • https://2b81f3f0-3f46-42ff-87a7-5865dd96cd3c.filesusr.com/ugd/fb41f9_ce916fdec7d64520a64ede9fdff67f30.pdf?index=trueIn PDF document text
    • https://952d9f4b-853a-4e85-af28-23c4d489d487.filesusr.com/ugd/8db125_f319cf19ca944a0bbf496c8aa4984c98.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/bovenotojitowe/kepemobeguxolarijoli.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002e555.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2E555 5068 bytes
SHA-256: d9dcb5b8cb112af3ff5d42848a523e27c440c28dbe90f4806e0299030824b89f
font_01_sfnt_off0002f69d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2F69D 12736 bytes
SHA-256: 78ca76d63b31e8eac3cdcdbb438a1f6927872a3e3c4a8da5502c2d15af90cf50

Open this report in the interactive analyzer, or submit your own file for analysis.