Malicious PDF — malware analysis report

Static analysis result for SHA-256 509dcf2542ce7696…

MALICIOUS

PDF

77.9 KB Created: 2021-04-03 20:00:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-20
MD5: 00ac1c5dfd0b2b18258c58efa01c2b8d SHA-1: 9cbc42657162c23dbca0e5c70a6d44ea54ad77b1 SHA-256: 509dcf2542ce76967b9cd8f5372d40c14fc6bd88bfed18deb5210f13b28fc3ce
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan. No scripts were extracted, but the presence of the malicious URL and the document's deceptive content are sufficient indicators.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=atlas+world+map+pdf PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4369765/normal_5fc673b35c2db.pdfIn PDF document text
    • https://cdn.sqhk.co/suxunuke/ieXplkL/extreme_speed_dragonite.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4420939/normal_5ff05cceaf608.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417413/normal_5ff9a7c36eb24.pdfIn PDF document text
    • https://cdn.sqhk.co/jupujezaxa/jRn4MmD/star_cinema_grill_vip_seats.pdfIn PDF document text
    • https://cdn.sqhk.co/tijinujul/jdkYLha/weed_killer_safe_for_pets_lowes.pdfIn PDF document text
    • https://cdn.sqhk.co/ridijafugemi/aThggja/59127483563.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4446499/normal_5ff079b9b1b7a.pdfIn PDF document text
    • https://cdn.sqhk.co/rubekafux/hbgigjy/hydraulic_wire_rope_cutting_machine.pdfIn PDF document text
    • https://cdn.sqhk.co/fijajiles/gOidyq9/free_music_download_apps.pdfIn PDF document text
    • https://cdn.sqhk.co/fekerepusa/zgckSru/64816787634.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384159/normal_60218a4eed8e7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4406497/normal_60461d1dd739c.pdfIn PDF document text
    • https://cdn.sqhk.co/gikasiful/ehj4Mia/70164108245.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379618/normal_601dcf7125ef6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4371514/normal_6025747f9a54c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387711/normal_6015f102b1417.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/gazivemon/how_to_read_music_notes_to_sing.pdfIn PDF document text
    • https://s3.amazonaws.com/zopenave/ministry_of_manpower_indonesia_website.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/521b6c6d-a3a0-4762-a961-c550164344b8/81784505527.pdfIn PDF document text
    • https://s3.amazonaws.com/vazisi/lojibafotajuje.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/948cf864-17fc-4c19-9595-130970b27095/young_living_compensation_plan_explained.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6ad59092-50e3-45c9-8b03-89c916a52550/jonodexalefidomumu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cc1d5d87-7375-4903-a431-aea2a8c4170c/difference_between_arbitration_and_adjudication.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f290.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF290 5268 bytes
SHA-256: f43599353368a58fee3a08b5ed5fb7d08ac7442c21b879d80f111d391fb5d824
font_01_sfnt_off00010474.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10474 10576 bytes
SHA-256: ed684215a0f8bd0f00aeb1fae9942520132ac463f726e96ca7e0513539c8d61b

Open this report in the interactive analyzer, or submit your own file for analysis.