Malicious PDF — malware analysis report

Static analysis result for SHA-256 2f0d3866d9b9cdea…

MALICIOUS

PDF

71.4 KB Created: 2021-02-12 03:55:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: 31e10d8a9ae212e3b2f689af25dd619a SHA-1: 61eb0d85d337a65061bcc38b350301192c297d7d SHA-256: 2f0d3866d9b9cdea0cf0292c8ccac04199beaaed25bba4503ba57acfd3d2ab33
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains an embedded URL, which is a common tactic for phishing or malware distribution. The ClamAV detection and ML classifier strongly indicate maliciousness, specifically flagging it as a phishing trojan. The embedded URL likely leads to a second-stage payload or phishing page, aligning with the spearphishing attachment technique.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wb?keyword=video%20cutter%20app%20%20filehippo PDF link annotation
    • https://cdn.sqhk.co/novujarogoga/i2iaTv6/64054084433.pdfIn PDF document text
    • https://cdn.sqhk.co/novozefox/eo9hchi/green_smoothie_recipes_for_belly_fat.pdfIn PDF document text
    • https://cdn.sqhk.co/xivovido/PluMsjg/screen_lock_time_password_android.pdfIn PDF document text
    • https://cdn.sqhk.co/butiluluvuk/ghgekkS/.pdfIn PDF document text
    • https://cdn.sqhk.co/pomorezolo/tjehicY/xevoxamixixemamim.pdfIn PDF document text
    • https://cdn.sqhk.co/puvegipuros/gfhaib7/jefesiwaja.pdfIn PDF document text
    • https://cdn.sqhk.co/rexadiwixox/jPgduVM/tedenalemekatilale.pdfIn PDF document text
    • https://cdn.sqhk.co/noperizapewo/ge5jfSZ/sowazamuti.pdfIn PDF document text
    • https://cdn.sqhk.co/gotakavapu/izdhihe/fejudoxamuxor.pdfIn PDF document text
    • https://cdn.sqhk.co/kixarozikej/WQjhjbI/mobile_kick_game_free_download.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/lorerexeg/ankush_movie_hd_song.pdfIn PDF document text
    • https://s3.amazonaws.com/kelukakeb/korean_drama_chinese_subtitle_free.pdfIn PDF document text
    • https://s3.amazonaws.com/moduxanakuri/tokozibetekipodemigerusi.pdfIn PDF document text
    • https://s3.amazonaws.com/lorerexeg/forrest_gump_music_sheet.pdfIn PDF document text
    • https://s3.amazonaws.com/bejeseja/fijibusiretowomul.pdfIn PDF document text
    • http://nosijatigatu.epizy.com/xedezurexexixesuxexosip.pdfIn PDF document text
    • http://liwukoxobumex.rf.gd/13425234599.pdfIn PDF document text
    • https://s3.amazonaws.com/farefasejikap/3256986546.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d7f4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD7F4 5032 bytes
SHA-256: d8ec707b0a7735f59ea18943676ed32f6ba9224b564898dbf63eb59d9068719c
font_01_sfnt_off0000e911.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE911 12228 bytes
SHA-256: 54d76470e5aeb101514f14cba75c8540d1ce684fae4da8089a9c6d6f13a65767

Open this report in the interactive analyzer, or submit your own file for analysis.