Malicious PDF — malware analysis report

Static analysis result for SHA-256 3bcc8429eb80325c…

MALICIOUS

PDF

107.9 KB Created: 2021-04-28 01:26:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8c91d785f5623551ba57052bd1e25ec9 SHA-1: b010a1d77bab9c0fbd599233ff801d5c0fd83730 SHA-256: 3bcc8429eb80325cb29ed2e15aef761e5d3fd0711439edc865febf803032081f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of multiple embedded URLs, many pointing to suspicious PDF files hosted on compromised websites, suggests a phishing or malware distribution campaign. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, hinting at its origin and potential use as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.farparts.cl/wp-content/plugins/formcraft/file-upload/server/content/files/1606c84fd3195c---tawiketukiw.pdf
    • https://dacoma.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160887b7eaf80b---1630263969.pdf
    • https://www.qlsny.com/wp-content/plugins/super-forms/uploads/php/files/71f058fa475162ef315f760543ca0218/49628129640.pdf
    • http://www.marcado.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1607cf5eb1f44a---99110658884.pdf
    • http://www.zopfitravel.com/wp-content/plugins/formcraft/file-upload/server/content/files/16080eca0169c3---wixupe.pdf
    • http://braintradingbcn.com/wp-content/plugins/super-forms/uploads/php/files/28f28da613d370bf45e487d68f0ff5a4/15509361281.pdf
    • https://ddriu.hu/wp-content/plugins/super-forms/uploads/php/files/4529035d37391e1816e4ef16348232f2/lupatixe.pdf
    • https://christianboudreau.com/wp-content/plugins/formcraft/file-upload/server/content/files/16078e9361b754---ropab.pdf
    • https://daleel.global/wp-content/plugins/super-forms/uploads/php/files/iq6esj71kbilm1qu1c74rd42s9/kidodi.pdf
    • https://metroguards.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1607880d848915---37523557291.pdf
    • https://fiambreszav.com/wp-content/plugins/super-forms/uploads/php/files/a66c1dcdb99e9201545c5b9c6a06b7fb/84162153664.pdf
    • http://cedresarquitectura.com/wp-content/plugins/formcraft/file-upload/server/content/files/16070c6ea727e1---19910869942.pdf
    • https://www.davinci.dk/wp-content/plugins/formcraft/file-upload/server/content/files/16084d19a4b668---xedanozirulafusozezija.pdf
    • https://fiambreszav.com/wp-content/plugins/super-forms/uploads/php/files/129d654938e059f673a9d950b3262e0f/fizotekulijad.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/cv9VXjIrmdE/uplcv?utm_term=deltascape+v1+savage+guide
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012c8a.bin
fed4653e02f761266842347845d5c9718c79c119e3bb9b9b2e570cbdec04c490		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12C8A 6720 bytes
font_01_sfnt_off0001430d.bin
755b12dc1a11e37be76d7a49bfe55c47426c1a2648f7857417f6bdeacdd1e88f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1430D 4924 bytes
font_02_sfnt_off000153ee.bin
c9f613932917897114452ca55fb366499ca3a8f72e019128daca4445ef4fdd75		 pdf-font-stream PDF embedded font (sfnt) at offset 0x153EE 12076 bytes
font_03_sfnt_off00017d51.bin
25a5e6c7c9cd73e1730f271d334b71b3c0ac6385951e3737251623a68d8eef5c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17D51 16160 bytes
font_04_sfnt_off0001924c.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1924C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.