Malicious PDF — malware analysis report

Static analysis result for SHA-256 45e3a8ddcd6074b5…

MALICIOUS

PDF

81.8 KB Created: 2021-03-17 20:27:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 69bf8a952e39c0b177a6bd0c3c83a238 SHA-1: bba47731d3dbb2f2d83744976e327e39461666f1 SHA-256: 45e3a8ddcd6074b570c381594987871755795129c71b3473231631d9c9573ded
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic indicating an external URI, which points to a suspicious domain. The ClamAV detection and ML classifier strongly suggest malicious intent, likely phishing or malware delivery. Although no scripts were explicitly extracted, the PDF structure and the presence of a malicious URL indicate an attempt to redirect the user to a harmful site, possibly for credential harvesting or further payload download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=graphing+exponential+functions+worksheet+answers
    • https://static.s123-cdn-static.com/uploads/4449422/normal_5febf6684e408.pdf
    • https://cdn.sqhk.co/tozegatopaxu/ijiegjF/talking_tom_angela_photo.pdf
    • https://cdn-cms.f-static.net/uploads/4369493/normal_604905c10e278.pdf
    • https://cdn.sqhk.co/tememagitapo/ahciahe/vujudegotumubagezud.pdf
    • https://cdn.sqhk.co/vumajotiwog/b9gj0Yf/dictionary_merriam_webster_download.pdf
    • https://cdn-cms.f-static.net/uploads/4370309/normal_5fd67c118a0a7.pdf
    • https://cdn.sqhk.co/wogokodu/dhrDahy/32750103505.pdf
    • https://static.s123-cdn-static.com/uploads/4369506/normal_6008f3b385cec.pdf
    • https://cdn.sqhk.co/zafupusapun/UFXjcji/99682539213.pdf
    • https://cdn.sqhk.co/jarogofef/fjfjgve/sumazatusow.pdf
    • https://cdn.sqhk.co/moserusoba/gfhhzji/marvel_stadium_events_manager.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/7ffc1cee-23ff-4917-8277-baeb380b62a9/zureta.pdf
    • https://uploads.strikinglycdn.com/files/b78da86d-547b-4ede-8be4-e8a791dea139/what_does_a_digital_transformation_manager_do.pdf
    • https://s3.amazonaws.com/senodiw/bulk_convert_html_to_word.pdf
    • https://uploads.strikinglycdn.com/files/be40a4e6-d656-448e-a4d9-bc6e512bc83b/wotelajo.pdf
    • https://uploads.strikinglycdn.com/files/f64a18d5-6015-4953-94ac-5bf044eeb77d/what_can_you_do_with_a_masters_in_health_psychology.pdf
    • https://s3.amazonaws.com/fevobelijogal/85705199492.pdf
    • https://s3.amazonaws.com/gifojuxaxeva/sazun.pdf
    • https://uploads.strikinglycdn.com/files/986ba3a9-1afa-4b6b-81f4-b7b72c93c771/76738963679.pdf
    • https://uploads.strikinglycdn.com/files/78c1b324-378c-4cc5-ae77-ec5e439f7cb8/christian_life_college_bookstore.pdf
    • https://s3.amazonaws.com/furunumaroxun/terebopifemu.pdf
    • https://uploads.strikinglycdn.com/files/9146ac79-88c6-4548-8c38-3f31f757ff19/soundcraft_ui12_default_password.pdf
    • https://s3.amazonaws.com/joterige/ufo_vpn_uptodown.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea5d.bin
48a3e634c3fbe7d35f97a6e59f3eab9c55d333a54ed5344549cada2bbe79b2bf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA5D 5532 bytes
font_01_sfnt_off0000fd49.bin
1f2bc906add00549181de2ba43c1dcb698d5c5ac881afa97f599b46a06ab9fa4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD49 11412 bytes
font_02_sfnt_off00012487.bin
c43c81af3addadc619f1b50b0eb79006c69e58cb90abf43f7a5fbd940e22698c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12487 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.