Malicious PDF — malware analysis report

Static analysis result for SHA-256 2e25ba34759a7e75…

MALICIOUS

PDF

95.2 KB Created: 2021-04-07 10:17:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6e53334637f915c88f5090f5d62127ab SHA-1: 9ebccf9b3d9e2ad22069baece35e6e2bd128c66e SHA-256: 2e25ba34759a7e75c3169f9975812fb5b9efefd6ca9db8a6729656e9115515b8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, indicating a phishing attempt disguised as a clothing catalogue. Although no scripts were explicitly extracted, the PDF_URI heuristic points to a URL that is likely used to deliver a secondary payload. The document body contains obfuscated text and metadata suggesting it was generated by wkhtmltopdf, a tool often used to create malicious PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8553

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.enwidth.com/sites/default/files/webform/resumes/zozagosetimof.pdf
    • https://www.blplegal.com/sites/default/files/webform/8025899801.pdf
    • https://www.termis.org/system/files/webform/vomijalikuwukilowerosi.pdf
    • https://www.natsihwa.org.au/sites/default/files/webform/doxuwekuwazomiloxeri.pdf
    • http://cicatsalud.com/html/sites/default/files/webform/17654710786.pdf
    • https://www.afscme65.org/system/files/webform/baxuwobokorexifiri.pdf
    • http://cicatsalud.com/html/sites/default/files/webform/sidetarebuw.pdf
    • http://www.muttypawsacademy.com/sites/default/files/webform/vaccines/37570077738.pdf
    • https://www.mothercare.ro/sites/default/files/webform/resumes/topijetidilotifoga.pdf
    • https://www.enwidth.com/sites/default/files/webform/resumes/22435641867.pdf
    • https://www.blplegal.com/sites/default/files/webform/julojulixizegusu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://feedproxy.google.com/~r/Uplcv/~3/3CAf4wW3hvY/uplcv?utm_term=barron+clothing+catalogue+pdf+download
    • https://gradfutures.princeton.edu/system/files/webform/buviboxakutovovujigobimis.pdf
    • https://campusrec.princeton.edu/system/files/webform/febapaxugodikuzakepob.pdf
    • https://www.ice.cam.ac.uk/sites/www.ice.cam.ac.uk/files/webform/46273532178.pdf
    • https://gradfutures.princeton.edu/system/files/webform/49692556615.pdf
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000128db.bin
0ffa31c8b06866b8c371e68f0c5f7dacdfc9f8c6a3e61494bdd7b8eeeccf295e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x128DB 5380 bytes
font_01_sfnt_off00013b31.bin
6d1fb5ad452c2fd5dcbf151480f2e4589f78ee37324535db155fc08180e9a308		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13B31 12252 bytes
font_02_sfnt_off00016523.bin
9210f4d56a2d0e868c92c8f3d69665b65103c4cbe8eccb0746292756ebfacc8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16523 16148 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.