Malicious PDF — malware analysis report

Static analysis result for SHA-256 339ff1596e913e4e…

MALICIOUS

PDF

77.1 KB Created: 2021-03-19 00:50:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5c281b179ec391349779fb17f1fccd28 SHA-1: 74f4c0042db08be4a0c017592376e6aa0213c9e8 SHA-256: 339ff1596e913e4e1a346be18c7b5665a3c448fe9956f29d5832c0ff58c41efe
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to a suspicious domain, likely intended to deliver a phishing or malware payload. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool sometimes used to create malicious PDFs. No scripts were extracted, but the presence of embedded URLs and the overall detection profile strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wix?keyword=north+bellmore+fire+department+hall+rental
    • http://online-sistem.site/cardiovascular_system_worksheet_middle_schoolgcxtn.pdf
    • http://xevusezes.medianewsonline.com/12382568766.pdf
    • http://axecheat6.xyz/35692532414o26x1.pdf
    • http://xufelaketodo.getenjoyment.net/tetisaginasesoloriwudakel.pdf
    • http://all-casino.xyz/26737247397xnr3u.pdf
    • http://zatoboyvibor.fun/8-1_word_problem_practice_geometric_mean_answers_with_workwvar8.pdf
    • http://sexedate69.site/oxygen_concentrator_rentals_near_me79wen.pdf
    • http://mandarins.space/reproductor_mx_pro_apk_aptoide4aaon.pdf
    • http://creditinquiry.info/microsoft_flight_sim_x_keyboard_controls2r0yc.pdf
    • http://rowowevu.mypressonline.com/abdominal_examination_checklist.pdf
    • http://gebikomuxe.getenjoyment.net/91223901597.pdf
    • http://realwockyc.info/vidmate_apk_free_iosnpqam.pdf
    • http://crispyset.online/what_is_scientific_statement299b2.pdf
    • http://xunarepozufuz.mygamesonline.org/body_movement_worksheet.pdf
    • http://ejinaya.com/what_alice_forgot_book_synopsis6kcl4.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://nujilexulajuwup.atwebpages.com/26535243748.pdf
    • http://zulolabopel.myartsonline.com/adverbs_position_exercises.pdf
    • http://lavoxema.onlinewebshop.net/antifungal_drugs_pharmacology.pdf
    • http://rosajeku.myartsonline.com/nofuduv.pdf
    • https://5a735b52-c4dc-41a0-ba14-66cfbda036e9.filesusr.com/ugd/3254bf_6d10a0e91c3a4a2db0119bb2344bbcdc.pdf?index=true
    • https://ec8c99fd-5413-4e38-b6a0-2ccbba71fc6f.filesusr.com/ugd/de02f3_148034551c564b368e5370388e73305d.pdf?index=true
    • https://ca108e69-7b6b-43f0-8f16-d96ebeb8a33d.filesusr.com/ugd/79e0dc_2ac92a981904489eb40318b2c644adac.pdf?index=true
    • https://63aa7d51-6c54-48cc-ac87-b710a0da19c3.filesusr.com/ugd/c8d394_ea21b949e1ef4b53973122fb4fb7923c.pdf?index=true
    • https://3c3713de-992c-4571-92b4-00afcb8cb2c1.filesusr.com/ugd/9dbdb2_3b6ac40b48c644418af9690e36f219e3.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed4f.bin
a631c963ad9d2632cbde795b781d720fae63a90c38863391c0f7ff4ed361dbfb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED4F 5212 bytes
font_01_sfnt_off0000fedc.bin
fa91a3b5c2f0e25611d9d8b19b1703835ea630f6922b379e3aec18cfd62b6aaf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFEDC 11220 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.