Malicious PDF — malware analysis report

Static analysis result for SHA-256 314750d8c31a942f…

MALICIOUS

PDF

78.2 KB Created: 2021-04-06 10:05:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c4e24176843b90cb6d3e9521047b06af SHA-1: 333f255f9ed0967a436534300064c9c59adc4ec5 SHA-256: 314750d8c31a942f206c871ab0d664ebb550e8050cf82f1a3636f4377e3ee8fa
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URI pointing to a suspicious domain, suggesting a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly indicate maliciousness. Although no scripts were explicitly extracted, the PDF structure and embedded URI are indicative of a phishing lure, likely attempting to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=red+lug+nuts+12x1.5
    • http://mufosubofamar.mywebcommunity.org/multiplication_word_problems_worksheets_grade_6.pdf
    • https://cdn.sqhk.co/puwupasakej/hfjihbl/mitoramizavadutura.pdf
    • https://cdn.sqhk.co/xajevedu/1yuhphi/battleship_puzzles_warship_empire_apk_mod.pdf
    • http://4338bacchus.com/how_to_scan_for_stocks_to_day_trade_thinkorswim3q1m7.pdf
    • http://memiwuv.mygamesonline.org/my_ge_front_load_washer_will_not_drain.pdf
    • http://gibelineg.sportsontheweb.net/surat_al_waqiah_arab.pdf
    • http://pasiworuwiwoz.getenjoyment.net/laboratory_guide_for_identification_of_plant_pathogenic_bacteria.pdf
    • http://copyrightsafetyhelps.com/518858936174v79k.pdf
    • http://swast-group.website/how_much_do_annie_and_david_get_paid_on_90_day_fiancegdtjf.pdf
    • https://cdn.sqhk.co/fumodolanes/giyicgi/minanurotufuxolozegej.pdf
    • http://tixesikixux.mygamesonline.org/5766203162.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/b6d288a7-7870-4115-a1ec-598cee0d3001/pujotutotisikokefesumitu.pdf
    • https://uploads.strikinglycdn.com/files/deee02f8-1e94-443e-bb17-f6e26e80fd5c/1353419748.pdf
    • https://uploads.strikinglycdn.com/files/15795828-e94a-4a10-b058-7b6cf5f7a439/how_to_reset_hdmi_port_on_vizio_tv.pdf
    • https://uploads.strikinglycdn.com/files/edb92df1-e32d-4e7a-8bee-3dd7a88e68ea/descargar_musica_de_anthony_santos_me_enamore.pdf
    • https://uploads.strikinglycdn.com/files/e45ef905-8d88-42c5-8b6d-df45744d98da/wujugatukekapiv.pdf
    • https://uploads.strikinglycdn.com/files/d1c90bea-97fb-4eb2-ad1a-54d2339c484b/adidas_watch_white_colour_price.pdf
    • https://uploads.strikinglycdn.com/files/6f0f302a-d60b-469a-8649-a7f8f1bb37f7/how_to_score_gre_verbal_reasoning.pdf
    • https://uploads.strikinglycdn.com/files/e2233073-8e80-4d84-ac5e-52cbde0797eb/suzuki_cello_book_11.pdf
    • https://uploads.strikinglycdn.com/files/0bcd95dc-09f6-4da2-b5cf-62368cb1e4e8/needful_things_movie_rating.pdf
    • https://uploads.strikinglycdn.com/files/aaef01e7-2b11-4c20-8198-388fb25b3b48/18136602358.pdf
    • https://uploads.strikinglycdn.com/files/9a897459-d7f3-47b6-ba72-fcc38fea0c8e/44893938849.pdf
    • https://uploads.strikinglycdn.com/files/da26b2d8-4efd-4f1d-a90f-1b52828cc53d/61776774894.pdf
    • https://uploads.strikinglycdn.com/files/2d04acd2-efe3-4ac9-8778-24c0e3e9fb8b/rusiwogunas.pdf
    • https://uploads.strikinglycdn.com/files/26d90a49-3299-4a2b-9f71-ab410a0d9124/tenow.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e566.bin
ac12b35375e8301efea2f9cfc67d7fa15114842afa53d6ca21916b615f510d64		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE566 4828 bytes
font_01_sfnt_off0000f5f8.bin
390e0278eab2b400633f7a950c63555b36583db06d21ed6226328f2be8fbc581		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF5F8 11108 bytes
font_02_sfnt_off00011bbb.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11BBB 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.