Malicious PDF — malware analysis report

Static analysis result for SHA-256 41f9ffad108c0463…

MALICIOUS

PDF

81.5 KB Created: 2021-04-29 09:52:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: cd74ec897d8b51081974937d87ae8cd2 SHA-1: e4e6528961d407800d25445b464b3c369dbc4b4f SHA-256: 41f9ffad108c04631aff1d753e2ddc7ff093491530d119b1a8b3895486f60e6b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=what+are+the+six+traits+of+writing+and+definition PDF link annotation
    • http://gamowenugeg.sportsontheweb.net/kaxaselibulazenobilov.pdfIn PDF document text
    • http://worelimupuvefam.mywebcommunity.org/81773737385.pdfIn PDF document text
    • http://movawizaxaxato.mywebcommunity.org/92211460009.pdfIn PDF document text
    • http://lenulari.mypressonline.com/bupobikuwaradate.pdfIn PDF document text
    • http://tufodudem.mypressonline.com/34409573605.pdfIn PDF document text
    • https://cdn.sqhk.co/bidogefapo/EZreAhi/57090187009.pdfIn PDF document text
    • https://cdn.sqhk.co/xeloxilava/Mgchdgg/dejoxelijo.pdfIn PDF document text
    • http://kepumomojixuwog.iblogger.org/rokagugelajukabovores.pdfIn PDF document text
    • https://cdn.sqhk.co/fabetojowuje/zgchfXe/sound_equalizer_app.pdfIn PDF document text
    • http://foselosen.sportsontheweb.net/17959495158.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://xarigezosuwa.rf.gd/empty_gumball_machine_template.pdfIn PDF document text
    • http://bivojeda.atwebpages.com/nibinubotudedagiperag.pdfIn PDF document text
    • https://s3.amazonaws.com/tuxenipup/58571193548.pdfIn PDF document text
    • http://xenezipulugiji.atwebpages.com/malaria_cerebral_fisiopatologia.pdfIn PDF document text
    • https://s3.amazonaws.com/rijaliwiguvex/affine_transformation_python_code.pdfIn PDF document text
    • https://s3.amazonaws.com/kimone/cet_result_2019.pdfIn PDF document text
    • https://s3.amazonaws.com/paropabaru/trio_tablets_for_sale.pdfIn PDF document text
    • https://s3.amazonaws.com/divelikubapiwaj/analysis_report_writing_example.pdfIn PDF document text
    • http://gunexukod.epizy.com/46048374981.pdfIn PDF document text
    • https://s3.amazonaws.com/mexijegedakol/95959804584.pdfIn PDF document text
    • http://pidodexogejax.myartsonline.com/pencil_drawing_images_of_girl.pdfIn PDF document text
    • http://sosefamip.epizy.com/senoxavowaxozesinuvozagu.pdfIn PDF document text
    • http://fusarafabar.epizy.com/27432336174.pdfIn PDF document text
    • https://s3.amazonaws.com/kuboki/how_to_use_vlookup_across_multiple_sheets.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000101e1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x101E1 5308 bytes
SHA-256: f47bee55a193b7dc6a4de465c3f6afa7efdec0be2ea73da5fc33d5402afca91c
font_01_sfnt_off0001140c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1140C 10584 bytes
SHA-256: 838469b40915de42ff0db118538f1af34af5e81346129ce27eec11fa42cb6f12

Open this report in the interactive analyzer, or submit your own file for analysis.