Malicious PDF — malware analysis report

Static analysis result for SHA-256 471c8f54bfd2b3ee…

MALICIOUS

PDF

179.7 KB Created: 2021-03-18 02:52:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: 2c73621a176d105d0b510e01f7b0d561 SHA-1: 57ab1eae9b4278d9a0de08cc80b691e8ade86c23 SHA-256: 471c8f54bfd2b3ee3d80e5ae3c57a86f00c7f50aa5ef10e550beb269429e0839
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL that leads to a domain known for hosting phishing content, likely intended to trick users into visiting it. No scripts were extracted, but the PDF structure and embedded URI suggest a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/wix?keyword=holt+mcdougal+algebra+1+chapter+7+test+answers PDF link annotation
    • http://mikrotikwizard.com/dd_druid_spells_knownbqwqj.pdfIn PDF document text
    • http://tesocoin.online/242297532767tzzd.pdfIn PDF document text
    • http://cetapp.xyz/pabifemul7e49x.pdfIn PDF document text
    • https://cdn.sqhk.co/sopiloroda/jgghigg/revenge_of_sultans_1._7_5_mod_apk.pdfIn PDF document text
    • http://zoosalon.org/liledifakazeqr5yc.pdfIn PDF document text
    • http://alsamcctv.com/soburaganadaradhn13.pdfIn PDF document text
    • https://cdn.sqhk.co/joxopejufito/ao4jfUj/snake_and_ladder_3d_pc_game.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://27a83426-c768-4525-a63d-b5b732cca755.filesusr.com/ugd/28b3f7_00f01289031946cb8e5890e2a937cc45.pdf?index=trueIn PDF document text
    • https://78ff948a-0765-49f5-a22c-0fbe0eba7848.filesusr.com/ugd/888d0b_27e3482f63fc408f9c88705f0f9fcb8b.pdf?index=trueIn PDF document text
    • https://75a697d3-84f0-44cf-bab9-f05e37020c50.filesusr.com/ugd/7c3584_baffb992d72b418aa466ba1fb526298b.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zibenoroduzuw/45082678791.pdfIn PDF document text
    • https://7ae52be2-ba3c-41fb-8935-29281088223e.filesusr.com/ugd/affaa6_83020f66c36d4d48b184a98250b341f8.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wobuzisibal/didriksson_regnstll_barn_storleksguide.pdfIn PDF document text
    • https://973697ad-ffa4-4f9d-85cd-0c9d1ea039ee.filesusr.com/ugd/5f5755_8a53c89e8a1e4860aff2ffaecebc713e.pdf?index=trueIn PDF document text
    • https://a0e9597c-cfbb-4fc1-b0e0-47ed6411b148.filesusr.com/ugd/24269e_11746217ff66425d9792d598a89e1804.pdf?index=trueIn PDF document text
    • https://6525eaf8-9a42-4119-9fb4-c3d475b3b78e.filesusr.com/ugd/80bfa9_e780f7415c3648c9a56c000accae68e1.pdf?index=trueIn PDF document text
    • https://8dfdba76-182f-4dc4-9dda-37a8c8d09dc9.filesusr.com/ugd/4ae4db_ada592ba10e7436cbf9ba1bd9e154b3f.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/pujirageg/zojijatudopewo.pdfIn PDF document text
    • https://s3.amazonaws.com/gurowozenupifi/dls_18_all_logos.pdfIn PDF document text
    • https://36535336-4f9e-4c0a-b1ad-3385cb5d4299.filesusr.com/ugd/15ebe2_35fb1154c9974d7f9c53451a08d45767.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fexuror/jabixemigaferobigomom.pdfIn PDF document text
    • https://72cee60b-533f-4fda-9f40-87b1bb6f0553.filesusr.com/ugd/590778_a7d6c35f0da24971b9d3013834285727.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000285ce.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x285CE 5812 bytes
SHA-256: f65b34c756ee064578a9244ec02147fdd4fb179f8623d5305688557eb40f6ec6
font_01_sfnt_off0002997a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2997A 11596 bytes
SHA-256: f3062e0b496d2dd7ee069a86e96ee62ba825b484cd68ec452400e1b44f32bc01

Open this report in the interactive analyzer, or submit your own file for analysis.