Malicious PDF — malware analysis report

Static analysis result for SHA-256 4d8368b4e5723363…

MALICIOUS

PDF

75.5 KB Created: 2021-03-21 03:04:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 98ed2ebf703ef08af3db56a9bf7c86ac SHA-1: e2229c8efd8b9a3d73b6570ef23d2dad83fc5535 SHA-256: 4d8368b4e57233630cbfeae32130faf42c257db2b87811880eea52164635a8be
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, which is a strong indicator of a phishing or malware distribution attempt. The ML classifier and ClamAV detection further support its malicious nature. Although no scripts were explicitly extracted, the presence of an external URI suggests an attempt to redirect the user to a malicious site, likely for credential harvesting or further payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/aws?utm_term=family+photo+photographers+near+me
    • http://tetupamino.mywebcommunity.org/how_to_write_a_case_study_proposal.pdf
    • http://xaredazisom.mywebcommunity.org/72440783622.pdf
    • http://hopecommunitynaz.com/el_nombre_de_jesus_kenneth_hagino8dp6.pdf
    • https://cdn.sqhk.co/niserutom/ErXgfLw/vovedepif.pdf
    • http://dressnbuy.com/wexupanscgv.pdf
    • https://cdn.sqhk.co/zukasedu/XhhWXje/download_robot_superhero_champions_mod_apk.pdf
    • https://cdn.sqhk.co/ranetixeba/hgeQREe/55416643330.pdf
    • https://cdn.sqhk.co/wezupobuwab/e3thbgi/90554136130.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/23a645d8-4959-46dc-bc21-185582b2f839/osha_approved_forklift_training_online.pdf
    • https://uploads.strikinglycdn.com/files/266aa3dd-c7c6-48b0-8922-9f69e0843dd3/ti_nspire_student_software.pdf
    • https://uploads.strikinglycdn.com/files/8cee474b-4b62-4422-b385-a7d03ac7a864/vector_smart_battery_charger_2_4_6_amp_instructions.pdf
    • https://s3.amazonaws.com/lakadutof/ponekanal.pdf
    • https://uploads.strikinglycdn.com/files/a0bba392-56f9-4cfd-bd5f-d6c148dbd288/do_you_need_25k_to_day_trade.pdf
    • https://uploads.strikinglycdn.com/files/7fe3cc89-10e5-405d-842c-d3ae761503b9/how_do_i_upload_photos_from_iphone_to_google_photos.pdf
    • https://uploads.strikinglycdn.com/files/a8c72a5e-258f-44da-934b-477fa20227fd/how_many_quarts_of_oil_does_a_2012_toyota_highlander_take.pdf
    • https://s3.amazonaws.com/fedure/75059907251.pdf
    • https://s3.amazonaws.com/sepovutapakogaf/56207314230.pdf
    • https://uploads.strikinglycdn.com/files/a10583d5-49df-4ceb-9605-1d6a0016ca00/fupevalo.pdf
    • https://uploads.strikinglycdn.com/files/050c98e6-52e0-4f68-b9d2-7e7649e14845/muxujizokomenerekajexi.pdf
    • https://uploads.strikinglycdn.com/files/41786305-8eca-480e-952f-45db2054c59d/how_to_attach_kitchenaid_bowl.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb38.bin
322590b417c04ac41fa2fb179965e1f754bd6b2099d7d8dd0ee203bc302abe39		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB38 5288 bytes
font_01_sfnt_off0000fd1a.bin
7f117bf4ee87e6b6e1a143a81b5ceb9de624feb8b7ee38b7293c56c44dd23555		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD1A 10468 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.