Malicious PDF — malware analysis report

Static analysis result for SHA-256 2e46de82c706ec38…

MALICIOUS

PDF

80.1 KB Created: 2021-05-23 18:01:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 5485c745fcef42e2489525fd3fbfdced SHA-1: 978bff9c97a3c06b5ca3e28c93ed20ae9c8ebfb5 SHA-256: 2e46de82c706ec388f2fe1a57bccb31612b5e11acb1819b882fcf2542646c0d3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that points to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also flagged this PDF with high confidence. The document body, though heavily obfuscated, appears to be a lure related to 'metabolic renewal hormone type 6', suggesting a phishing or scam attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=what+is+metabolic+renewal+hormone+type+6 PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4369331/normal_60100846c176b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4379615/normal_5fe10557864da.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4501495/normal_60021d2d6451d.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/c1dd9743-311a-4af6-a577-a82db671c57d/89839463049.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0efd6e03-dc0b-4a90-a79f-ef4477646a52/how_do_i_make_frozen_fries_in_my_ninja_air_fryer.pdfIn PDF document text
    • https://s3.amazonaws.com/mubefula/sojupi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/19bda807-7b82-4b5e-91a3-93bf94bf5070/44683642494.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/863f95e2-54e4-467f-9694-ed237acd4544/black_and_decker_toaster_oven_manual_to3260xsbd.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/44b7c6ec-2d34-451b-8f28-4c87bbd7d39f/diary_of_wimpy_kid_rodrick_rules_book.pdfIn PDF document text
    • https://s3.amazonaws.com/zurovajij/kuvijirumifikatotuxawa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/73f58605-7506-492a-a696-08eef94a232e/el_cordova_hotel_coronado_ca.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0dad7856-df65-48d4-8f0e-934a8b8930a7/tiputezezuv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ee0fa6bd-0b04-4ce2-a801-f08f64788f8a/39158722303.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/806d534e-74ab-4a35-9378-3e275aba0b9e/47558891530.pdfIn PDF document text
    • https://s3.amazonaws.com/kumasala/zotajugalopive.pdfIn PDF document text
    • https://s3.amazonaws.com/jukoxisojow/que_tipo_de_archivo_de_audio_acepta_whatsapp.pdfIn PDF document text
    • https://s3.amazonaws.com/wolina/maytag_neptune_washer_wont_spin.pdfIn PDF document text
    • https://s3.amazonaws.com/lowebemuwojiso/81745681775.pdfIn PDF document text
    • https://s3.amazonaws.com/lixisariwulo/world_physical_map_blank_a4_size.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b9deaf49-eeed-454b-b09e-e716ac8a1d06/32412323712.pdfIn PDF document text
    • https://s3.amazonaws.com/nademopor/battle_of_the_sexes_questions_quizlet.pdfIn PDF document text
    • https://s3.amazonaws.com/nigimul/78603781929.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cf0b85d3-a582-4004-a853-640ace8ba9fe/is_cancun_safe_from_covid.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f8ad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF8AD 5676 bytes
SHA-256: 85886f9ae4f87622a0d6e5f0739dc5e96f2919651ff62460cc42d2efa08e8ecc
font_01_sfnt_off00010bea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10BEA 10732 bytes
SHA-256: 3f9670a1b6d833054c09e29fff2d8aa1b55822456489072e50fa03252f98a09d

Open this report in the interactive analyzer, or submit your own file for analysis.