Malicious PDF — malware analysis report

Static analysis result for SHA-256 3b940fc99a6c73fc…

MALICIOUS

PDF

72.5 KB Created: 2021-03-12 18:08:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 65b75435808cd9afd7ecfaa56987dfae SHA-1: 6667b309dcdb48258b586d96a304f8e20b6f9387 SHA-256: 3b940fc99a6c73fc74ee2f85a226909252dc6d9e05b20a5ebc3def8d8e410026
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The PDF contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing site. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wix?keyword=stealth+guided+brain+surgery
    • https://xoredanixeg.weebly.com/uploads/1/3/0/8/130814516/4260417.pdf
    • http://navevukosuso.mypressonline.com/credo_catolico_largo.pdf
    • https://sokikafumuwo.weebly.com/uploads/1/3/4/6/134697409/7564986.pdf
    • http://xofebuledat.scienceontheweb.net/kebutuhan_dasar_manusia_dalam_keperawatan.pdf
    • http://gojavodevagajuw.mygamesonline.org/mobadogaxot.pdf
    • https://cdn-cms.f-static.net/uploads/4476569/normal_5fe910174e187.pdf
    • https://static.s123-cdn-static.com/uploads/4489848/normal_5ffefe3d7e251.pdf
    • http://nutosuvitiraj.scienceontheweb.net/arms_reach_co_sleeper_versatile_bassinet_weight_limit.pdf
    • http://dimozakebaba.scienceontheweb.net/pizogigisesi.pdf
    • http://xojuxelase.medianewsonline.com/tadijeguravav.pdf
    • http://zokupez.mygamesonline.org/17848623205.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/kukupunopedon/xolukasukixefexozo.pdf
    • http://muferipimakolop.rf.gd/botixajigozeke.pdf
    • https://s3.amazonaws.com/jazamerijekufol/16571526361.pdf
    • https://s3.amazonaws.com/viboxikuz/uk_highways_traffic_reports.pdf
    • https://s3.amazonaws.com/tesapibebujep/30266620543.pdf
    • http://nokuwoti.rf.gd/aditya_hrudayam_in_bengali.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e01d.bin
a992b42481bf9032e70442b54dc9e2eac241e50e82f634fd0a984ba6e16c93f1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE01D 5432 bytes
font_01_sfnt_off0000f288.bin
957d312369e69d83a12811262ada396093417a7395eb534b6c48c4c384d2af95		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF288 10168 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.