Malicious PDF — malware analysis report

Static analysis result for SHA-256 4f83e1a40176e49e…

MALICIOUS

PDF

115.5 KB Created: 2021-05-21 21:04:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 4dbff9b2f057697d86ee0ed788d1c554 SHA-1: 2cf4933e4d34ee9ff92fe15f9d25f33474650abe SHA-256: 4f83e1a40176e49e4d3eb3c2620b0bee2aab73e2c2f6f19c811a3783275effbe
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing site. While no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to exploit users through a malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/strik?utm_term=one%2527s+own+wishful+thinking+in+chinese PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4467979/normal_602b76eb24216.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447098/normal_60659405658e7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446147/normal_60237e6f28cda.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4424645/normal_5ff4e902d8211.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4475580/normal_5ff90e20eb723.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xofalepelala/saxusatizumafa.pdfIn PDF document text
    • https://s3.amazonaws.com/sifawekujiki/sataro.pdfIn PDF document text
    • https://s3.amazonaws.com/retisovojor/6051202996.pdfIn PDF document text
    • https://s3.amazonaws.com/zosevid/68878233136.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b3b992e7-8121-4ad6-9dc2-4aeb97a89d6a/pupisilapekulamovat.pdfIn PDF document text
    • https://s3.amazonaws.com/jesidofefe/digitech_gnx3_review.pdfIn PDF document text
    • https://s3.amazonaws.com/kifutizijebuj/the_beths_out_of_sight_tab.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cfca542c-f503-4190-9445-a706cf48a5a4/nonudoratevovopit.pdfIn PDF document text
    • https://s3.amazonaws.com/baxekojojexusol/information_technology_project_proposal_template.pdfIn PDF document text
    • https://s3.amazonaws.com/nafoxuda/76931493398.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/be9dc4a4-66dc-48e5-9333-e81af11d4f78/42492664722.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/64229b33-81d1-47dd-9356-e85558df22c3/how_can_i_check_my_covid_19_test_result_online_in_india.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c29a4b5b-b777-4ec0-8c91-74cf21e41d9a/77872007580.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/db8abcf2-682f-4b74-9f9b-97ec85a430d0/44304145573.pdfIn PDF document text
    • https://s3.amazonaws.com/pazerogasarinu/82040314618.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cc9376c0-2ec4-408e-927b-20519fc8a660/95575976051.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f199fee4-2c46-46f3-9633-a547921d1b37/sisters_book_by_raina_telgemeier_summary.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fa55.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA55 45616 bytes
SHA-256: e81d72fd36f27e9e4a5ebff2e76081be7b809457749ebc618cba2c397538ab41
font_01_sfnt_off00018454.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18454 5052 bytes
SHA-256: 9def7c14bf25d1d265e894d4971f6992b94e6a81acc8a63701057ea94763a14e
font_02_sfnt_off000195ad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x195AD 12316 bytes
SHA-256: bbb98c16025f635dc48712dbf8f4df6afb0f5c016d6d61a281898ff85c432881

Open this report in the interactive analyzer, or submit your own file for analysis.