Malicious PDF — malware analysis report

Static analysis result for SHA-256 3f0362544cd7af18…

MALICIOUS

PDF

78.8 KB Created: 2021-04-07 20:55:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: c68fc11b4ae3a08a29f94d8fb788a9d3 SHA-1: c7fd822674eafd3d3348cc32adcb16234756f199 SHA-256: 3f0362544cd7af18a3dbe4ec6ceddb185fcc1efe6fde0c880f567080b32b5c96
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was flagged by a machine learning classifier and ClamAV as malicious, with heuristics indicating the presence of external URIs. The embedded URLs suggest a phishing or malware distribution attempt, likely disguised as a document download. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/strik?utm_term=saxon+algebra+1+pdf+download PDF link annotation
    • http://powerpoint4you.ru/android_emulator_paling_ringan_2019dyy9j.pdfIn PDF document text
    • http://prodson.space/balance_of_payment_concepty9r7c.pdfIn PDF document text
    • http://alsamcctv.com/bose_remote_control_codes_cinematerxel1.pdfIn PDF document text
    • http://elinekici.online/9059219835703mka.pdfIn PDF document text
    • http://natbeach.space/jepawizogovexubib4i.pdfIn PDF document text
    • http://small-italy.space/private_lacrosse_training_near_me3g14s.pdfIn PDF document text
    • http://50offit.pro/59694847250hjcsw.pdfIn PDF document text
    • http://lnstagram-blue-badge-form.com/zigigerobupebimh.pdfIn PDF document text
    • http://tryne.xyz/3791034654linal.pdfIn PDF document text
    • http://dsv-trening.ru/how_to_add_an_image_to_a_header_in_wixhyq12.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4406771/normal_606136ea922d2.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4452839/normal_5ff81b56bcc7e.pdfIn PDF document text
    • http://ontrade.top/37510436416p2zfz.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/regovadeje/the_luck_uglies_book_series.pdfIn PDF document text
    • https://c3438639-6a75-4920-aa4f-d1e0b619354f.filesusr.com/ugd/3be3a7_77cb5bc4a0344490aa3f389022b58fa4.pdf?index=trueIn PDF document text
    • https://b6c9d0de-81a1-4db9-ab7d-8a95af9e63d6.filesusr.com/ugd/b28ae2_fc7f5275fb144d4481ef453f9663a6d8.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/winumigutam/calc_2_final_study_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/sebunuzu/ball_games_free_for_mobile.pdfIn PDF document text
    • https://s3.amazonaws.com/xukanomarexumu/90608454653.pdfIn PDF document text
    • https://ac3db616-04cb-40f1-8357-c67041f5e20c.filesusr.com/ugd/eda9ba_24bd3e8501094a9890122615fb44183e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/batiku/argumentative_essay_template.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f50b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF50B 5484 bytes
SHA-256: 06067ac5878589772f2910a033c5d609400fa33d636d659a6a23b7c97f42abc9
font_01_sfnt_off000107db.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x107DB 10976 bytes
SHA-256: 15850e85899d48700a061154f144ccd4eb97fd98a25c6453cd8e917a4014b2ab

Open this report in the interactive analyzer, or submit your own file for analysis.