Malicious PDF — malware analysis report

Static analysis result for SHA-256 2fc1f4c97dae94dc…

MALICIOUS

PDF

208.7 KB Created: 2021-03-31 00:08:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: 0b92c32f72baf89c42ae6b710c4f9d64 SHA-1: 34a86c8ed364989ed4c69346893a26c81ab6a6ea SHA-256: 2fc1f4c97dae94dcd3ce4334c2473556640501250dcf8667303caafddd165b23
194 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment

This PDF document was flagged as malicious by ML classifiers and ClamAV, indicating it is likely a phishing or trojan delivery mechanism. The presence of a 'Clipboard command execution lure' heuristic suggests the document instructs the user to copy and paste commands into a shell, a common technique for executing malicious payloads. The embedded URL points to known malicious redirector infrastructure, further supporting the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9771

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/wix?keyword=standard+keyboard+layout+crossword In PDF document text
    • https://tekudijasefemo.weebly.com/uploads/1/3/2/7/132740256/4701155.pdfIn PDF document text
    • http://tafuxasomup.getenjoyment.net/pafijinab.pdfIn PDF document text
    • http://bagesopabiwub.scienceontheweb.net/ecologia_ambiental.pdfIn PDF document text
    • http://kakafeg.scienceontheweb.net/veterinary_microbiology_and_microbial_diseases.pdfIn PDF document text
    • https://tevaxuxelajuri.weebly.com/uploads/1/3/2/7/132712575/528e0d1bf43c28b.pdfIn PDF document text
    • http://lobabinuladeri.medianewsonline.com/62044908255.pdfIn PDF document text
    • http://kigaruzolalo.mypressonline.com/xuvogaj.pdfIn PDF document text
    • http://mamubisuk.mypressonline.com/czciowe_tumaczenie_zda_angielski.pdfIn PDF document text
    • https://likuwiwekadu.weebly.com/uploads/1/3/1/8/131857000/fotufugo.pdfIn PDF document text
    • http://topafigo.mypressonline.com/bjh_method_pore_size_distribution.pdfIn PDF document text
    • https://guxevelanitab.weebly.com/uploads/1/3/4/7/134769418/2870072.pdfIn PDF document text
    • https://wisemawuperu.weebly.com/uploads/1/3/0/7/130738751/6896793.pdfIn PDF document text
    • https://tulugawaluga.weebly.com/uploads/1/3/0/9/130969515/zurezevujepuz_jiwaradovaj_woguxugerolatum.pdfIn PDF document text
    • https://numeroluxovuz.weebly.com/uploads/1/3/4/7/134733954/rolalene-kixuvusobak-biguvalutinetox-buredud.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/2038f53a-475a-44c6-b523-9545200fa2f2/towurogaxexinovuge.pdfIn PDF document text
    • https://010f2e21-25ca-4560-806d-08cbbb7c7db1.filesusr.com/ugd/74a852_6f0ca8cf01f9447cb0d6d0665172e732.pdf?index=trueIn PDF document text
    • http://zuputes.atwebpages.com/kabukununoxowuzarajafomi.pdfIn PDF document text
    • https://59bb578d-b312-442a-858b-1a1a54b18a6c.filesusr.com/ugd/c79b1c_79f1f2d9037e4761bef64fe8f03b082f.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/5220ca9d-979a-4025-9af5-1fdb1756cfb3/5815574757.pdfIn PDF document text
    • https://77047a80-9f17-4504-a563-a097c25ca12e.filesusr.com/ugd/5c8b2f_b38c42d47a404799a5eb05da4e67027a.pdf?index=trueIn PDF document text
    • https://dbba0f06-1911-40f0-8c80-a2638c7f81cc.filesusr.com/ugd/b13fd1_a006ff624af94338a78bb33a0d945a9b.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/5f40b4db-268d-47f7-8304-e18cc27cff4c/bill_of_exchange_format_in_word_file.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000291af.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x291AF 6768 bytes
SHA-256: e14588ac57d2f33183b8e2a47f0b3bfd87d8667a1b4948329e116885183d0b32
font_01_sfnt_off0002a2a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2A2A9 5436 bytes
SHA-256: c8d6bb32e2eba7e9879424f2301046b39fdb540f505d3fdb38022aef34678032
font_02_sfnt_off0002b53d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2B53D 2004 bytes
SHA-256: 35cb21fdb618efd7041eee26779fe95fdf0a80cdc9fe6086b0d69ce776a47990
font_03_sfnt_off0002bed3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2BED3 40416 bytes
SHA-256: c2ca61a4159e82fdb24a63f7ed77fe5478d77b9e450725244e2c0596354f50ed
font_04_sfnt_off00031d25.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x31D25 16480 bytes
SHA-256: 066015758395716d208841877aacddd837b9ddd443891aa11a745fadb8ab007e

Open this report in the interactive analyzer, or submit your own file for analysis.