Malicious PDF — malware analysis report

Static analysis result for SHA-256 45cf53b4abf5cc99…

MALICIOUS

PDF

75.8 KB Created: 2021-05-12 19:47:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 21fb75216c23f70a1a97f2ebf243c1cb SHA-1: 989992b74f687b92c94fd9c1489c2fbb3ff8f699 SHA-256: 45cf53b4abf5cc9907585b1ea2075d69865e425715203eee88a381ff0545a53b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site. ClamAV and ML classifiers also flagged this PDF as malicious, indicating a phishing or trojan distribution attempt. No scripts were extracted, but the presence of external URIs suggests an attempt to download further payloads or conduct phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=troy+bilt+gas+trimmer+head+replacement
    • http://dommasters.site/99766605627wyv8v.pdf
    • https://cdn.sqhk.co/xojurolaruk/hNSibzX/navalugunopa.pdf
    • https://cdn.sqhk.co/junuxuseg/6ihgci9/word_connect_crossword_level_168.pdf
    • https://cdn.sqhk.co/sesudegaruta/gj7qpig/wild_crocodile_sim_3d_mod_apk.pdf
    • http://vvd.bar/plan_de_negocio_de_un_restaurante_vegetarianofaou3.pdf
    • http://the-english-temple.com/how_to_restore_your_bodys_ph_leveltzzqr.pdf
    • http://romeital.space/ramp_buggy_gtaw4597.pdf
    • https://cdn.sqhk.co/nunexijezep/dgfIibn/30053111026.pdf
    • http://static-start.top/71996178483ds1zl.pdf
    • https://cdn.sqhk.co/joziroluxu/5q7X7FR/zekusinolamulurafinewex.pdf
    • http://4gusevshop.space/degabupixizuvimupitublexx0.pdf
    • http://spencermcman.us/howls_moving_castle_3rd_bookix7k0.pdf
    • http://vinorama.fun/a_simple_favor_soundtrack_mp3_download9n6tg.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/tidigudetefumof/29536098075.pdf
    • http://ramimivojis.rf.gd/zawedaserovigudar.pdf
    • https://s3.amazonaws.com/bakoloj/54403966981.pdf
    • http://vaberizop.epizy.com/bobol_wifi_wpa2_dengan_android_tanpa_root.pdf
    • https://s3.amazonaws.com/loxopudizus/information_technology_business_analysis_course_in_conestoga.pdf
    • https://s3.amazonaws.com/dipafuxe/why_isnt_hbo_max_on_apple_tv.pdf
    • http://wedemato.rf.gd/caprice_24_john_williams.pdf
    • http://jeburam.epizy.com/nebobedexo.pdf
    • http://mejesikuwuvaxax.rf.gd/antigone_fagles.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9f2.bin
324ce071014f06e5d6e2827bc4e8744a8b0c52d223098fedfa48b7eb3abd2915
pdf-font-stream PDF embedded font (sfnt) at offset 0xE9F2 5680 bytes
font_01_sfnt_off0000fd1b.bin
c9846d1ae59cafe4f9eb22081515be9ebe459a09734eb2694e95e360926ab504
pdf-font-stream PDF embedded font (sfnt) at offset 0xFD1B 10588 bytes