Malicious PDF — malware analysis report

Static analysis result for SHA-256 51b0969b3b8ffb70…

MALICIOUS

PDF

73.0 KB Created: 2021-03-14 01:27:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: fed5fc01acf5151126715cf6a97418ac SHA-1: e2f7025a8485eb0a93370fa4bb2e7588daaace3b SHA-256: 51b0969b3b8ffb707002be20c3c787d09fc134bee99abce0b7491800f3b16f1f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to host a malicious payload or phishing page. The document body, though heavily obfuscated, appears to be a lure related to 'psychological realism in theatre'. No scripts were extracted, but the presence of an external URI and the malware detection strongly suggest a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/strik?utm_term=what+is+psychological+realism+in+theatre PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4402000/normal_5ff9e8c78ac7d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4499979/normal_604ac8fedfbaa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365646/normal_604d2cf113c3c.pdfIn PDF document text
    • http://jefevivavifax.scienceontheweb.net/niruxexifegugitaxubet.pdfIn PDF document text
    • http://duwudivusupo.mygamesonline.org/days_of_the_week_in_arabic.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4425726/normal_5ff1df1939694.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4387920/normal_600458cc0597e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4390056/normal_5fec8fdf09cd6.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://6998e30b-c911-4113-ab34-4c15204891c7.filesusr.com/ugd/429b25_5842a1cddb0a45d785ba19e3ed67ba1c.pdf?index=trueIn PDF document text
    • http://mowesedapi.epizy.com/windows_10_1903_failed_to.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d8dd8e4a-17fc-49cc-87a2-200b285f13fe/q_significa_m_en_un_diccionario.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1e95b042-fc54-42fd-8259-551c1e2e0b33/8169704417.pdfIn PDF document text
    • https://e8329085-1058-49d3-a03f-79dfd6d7647e.filesusr.com/ugd/f96b02_c0ac1fee62374f70aad769b6479631de.pdf?index=trueIn PDF document text
    • https://6db1e9a2-4282-4636-8d41-de07325ad911.filesusr.com/ugd/d97b38_1d2f3e365d93427d87763f996c4732a3.pdf?index=trueIn PDF document text
    • http://regisebe.epizy.com/98856624617.pdfIn PDF document text
    • http://tavejetenugaku.epizy.com/5996652671.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e062.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE062 5464 bytes
SHA-256: cdc1e6b6d6d0e55b826558ab11e1af271e5d18d7652b9d7554b13a0060efd89c
font_01_sfnt_off0000f2e2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF2E2 10684 bytes
SHA-256: 5dd1755b376a2840ae9e34bba8fc4c62bba8a806069e2b2480be925fb83d3973

Open this report in the interactive analyzer, or submit your own file for analysis.