Malicious PDF — malware analysis report

Static analysis result for SHA-256 344893ca58a804ec…

MALICIOUS

PDF

72.7 KB Created: 2021-03-09 14:32:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9c2c2fc56392cccf74fa878306a8cdb7 SHA-1: 2aeedad1ff0294820ff7e67504f7efc1565e2f96 SHA-256: 344893ca58a804ec674169aea533b69ae2556af94afa26d21a9a149ff2a553cc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by both ML classifiers and ClamAV, indicating a high likelihood of malicious intent. An embedded URI points to a suspicious domain, likely intended to host a malicious payload or phishing content. While no scripts were explicitly extracted, the PDF structure and embedded URI suggest a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/aws?utm_term=hayward+t9+salt+cell+installation
    • http://pararapameso.getenjoyment.net/dopesej.pdf
    • http://luwogexejel.getenjoyment.net/attack_on_titan_manga_last_chapter_release_date.pdf
    • http://warowusavi.mywebcommunity.org/65407183126.pdf
    • http://xijulefabogi.getenjoyment.net/python_gui_programming_examples.pdf
    • http://mufutekuson.getenjoyment.net/muwasubaw.pdf
    • http://fajasated.mywebcommunity.org/74582695751.pdf
    • http://italia-doc.fun/nemunm4b55.pdf
    • http://hr-insider.com/ruzosizutoxajqco5.pdf
    • http://yogist.fun/jirubodomubobamurugil56yj.pdf
    • http://fineagencyy.com/74322090212z8c2n.pdf
    • http://fosipuzo.mypressonline.com/what_were_the_key_ideas_of_the_magna_carta.pdf
    • http://walolexokesufa.sportsontheweb.net/pojupipo.pdf
    • http://plsale.pro/model_3_range_drop_after_software_updatewcir7.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://takikixak.rf.gd/are_unmarked_police_cars_legal_in_washington.pdf
    • http://mirokuf.rf.gd/79548362929.pdf
    • https://7133fc40-0b9c-4701-b953-e7fafc934b44.filesusr.com/ugd/70a38d_31c17edfa7d34746a53d503fa4814286.pdf?index=true
    • https://uploads.strikinglycdn.com/files/48023559-032e-4088-bdb4-e42c86918bb0/google_maps_show_satellite_view.pdf
    • http://wajufuful.rf.gd/wewitamuvupaxupax.pdf
    • http://gudazakagozugaj.epizy.com/48609774438.pdf
    • https://0e75ab8e-f6a1-4360-bef2-1d94e06fde4e.filesusr.com/ugd/c0518c_48803ff80621440a8e9933baf05e6a1c.pdf?index=true
    • http://vokulokunupada.epizy.com/41132585870.pdf
    • https://uploads.strikinglycdn.com/files/77051c6d-6a5f-4fc2-87a3-ebeca8cc7a2c/27926152390.pdf
    • https://6b5d12f1-3bbc-48af-9ddb-5430d2fe15e7.filesusr.com/ugd/3bf302_d833c1d67b16401c9864d7ab6892ca7b.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e157.bin
eddcde6bd4379b17004ff806e14e03554eabf1c22ab57d0750f52da8972bffb4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE157 5244 bytes
font_01_sfnt_off0000f34d.bin
b935458b9048a19c9c4e4bae75e7c805121521decf97d4ce9c70be9785e91fb6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF34D 10052 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.