Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a2cf0be602f9954…

MALICIOUS

PDF

86.8 KB Created: 2021-03-22 09:27:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 073633300d5385aaaa6bc2e1efda093c SHA-1: dea4c8d263c3e0a5ae4786f2eca918e0c262b287 SHA-256: 4a2cf0be602f99545d84aaa809b8c81030960ee907b642e7dfef0e24f800c8b0
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains an embedded URL that mimics a search result, likely intended to trick the user into clicking it. The document body is heavily obfuscated, but the presence of the external URI points to a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=how+much+does+it+cost+to+refill+ink+cartridges+at+costco
    • http://anyita.space/9223850215531n7l.pdf
    • http://bluhgang.best/261253569343l0iy.pdf
    • http://save50it.info/did_you_hear_about_pre_algebra_with_pizzazz_page_20425ymy.pdf
    • http://copyrightsupportforlnstagram.com/bolesefez50y13.pdf
    • http://idealica-official-it.website/papiwoseke6egd.pdf
    • http://alexandreablog.com/bikini_body_guide_food_plan8z2ta.pdf
    • http://fragcups.com/badger_5_garbage_disposal_specsp2lgw.pdf
    • http://kapusta.pro/escuchar_conversaciones_ingles_basico_gratiskf8it.pdf
    • http://dixukegeruxu.22web.org/1126701399.pdf
    • http://jegotaraxipux.iblogger.org/5426802492.pdf
    • http://it50save.info/how_to_turn_on_hamilton_beach_commercial_ironzj7lk.pdf
    • http://my-favshopc.online/flight_of_the_bumblebee_flute_letter_noteskyu1c.pdf
    • http://vinnipoh.space/49267948083jhkjz.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://jisemitasun.epizy.com/66129058129.pdf
    • http://wikatamuk.rf.gd/spanish_army_uniforms_1800s.pdf
    • http://wiroweri.rf.gd/logitech_illuminated_keyboard_k800_review.pdf
    • https://s3.amazonaws.com/jifesu/90174892964.pdf
    • https://uploads.strikinglycdn.com/files/62f30a7e-9bb1-45a4-a3cf-e1a955d3ffbd/leather_computer_backpack_womens.pdf
    • https://uploads.strikinglycdn.com/files/853c4285-a7f6-4dd5-b0f3-3b468fd051db/78039546410.pdf
    • https://uploads.strikinglycdn.com/files/54518990-57ed-4bea-b68f-5527261866de/dogapejoguzipajipasise.pdf
    • https://s3.amazonaws.com/tumuzu/93368971227.pdf
    • https://s3.amazonaws.com/wekibik/41301231297.pdf
    • https://s3.amazonaws.com/kozewuposoridil/36415906731.pdf
    • https://uploads.strikinglycdn.com/files/794afd72-4251-4957-bd15-b3ba99781477/92552365956.pdf
    • https://uploads.strikinglycdn.com/files/2c0ad0d9-e539-418e-bf30-329e8ab38561/the_tanya_chabad.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000114c1.bin
473acf52d25fa6af0dcc631e3112b17824b822224cf4393fca916378e0e3fe2e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x114C1 5552 bytes
font_01_sfnt_off00012788.bin
b4957fd0e696a17ddd0d0128f1135deeb469a08ba4aa5e5d609624010d0d93f2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12788 11048 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.