Malicious PDF — malware analysis report

Static analysis result for SHA-256 5254ba9a0fec7930…

MALICIOUS

PDF

80.5 KB Created: 2021-04-24 21:46:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9ccf675f5148891b239fc159feb4b7d8 SHA-1: 59c728d927aae0fc5242e4a8e3f513ed5d9be5fa SHA-256: 5254ba9a0fec793024ff321e14f53c77e33037fc10f9c17dfa3f71d3ed3c231a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to a suspicious domain, likely intended to host a phishing page or download further malware. The document body, though partially garbled, suggests a lure related to '6 sigma yellow belt' to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=what+is+6+sigma+yellow+belt
    • http://jarisudowapebi.sportsontheweb.net/40650059829.pdf
    • http://dulisakip.medianewsonline.com/moscow_metro_map_english_2020.pdf
    • http://mazejofeg.mygamesonline.org/59201405634.pdf
    • https://static.s123-cdn-static.com/uploads/4387430/normal_5ff65cd3515f3.pdf
    • http://nebatomefov.scienceontheweb.net/bifovopukedetefuzavo.pdf
    • http://sizuxofutitarax.mypressonline.com/italian_english_visual_bilingual_dictionary_free_download.pdf
    • https://cdn-cms.f-static.net/uploads/4482218/normal_6067c995920d5.pdf
    • http://bosemefawixuwov.mypressonline.com/570875039.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://dufobirufo.atwebpages.com/new_garmin_430w_for_sale_fairmont_wv.pdf
    • https://f110cc6a-49d6-427c-9ab6-a3a4d323b004.filesusr.com/ugd/9e53d4_24a2150d40a749cd80557bc63c3493e7.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a603bbb3-1fec-4efb-a0e4-7f76fe88ab40/xapuxabodomot.pdf
    • https://uploads.strikinglycdn.com/files/740d003b-b4df-4077-a695-5f89f9d79c40/42633450415.pdf
    • https://4a31e3f8-49e3-4331-b1a9-c0bb7a6b9dbc.filesusr.com/ugd/599f1c_16f510d34e2746a897afaec7321c910a.pdf?index=true
    • https://42172c5f-463d-425f-bc49-3536d5e9b788.filesusr.com/ugd/3e9aab_64cd4954cf4249dda7170e4e8b96dd03.pdf?index=true
    • http://difadedox.rf.gd/hernia_de_hiato_classificao.pdf
    • https://uploads.strikinglycdn.com/files/a7fdf011-5145-440e-b53b-84f23f13b70a/17674629366.pdf
    • http://wilosokanik.myartsonline.com/lizilituwub.pdf
    • http://wapanemajefo.rf.gd/windows_active_directory_interview_questions_and_answers.pdf
    • http://wuzuferopo.epizy.com/c_language_notes_for_bca.pdf
    • https://uploads.strikinglycdn.com/files/0003c3cd-0c4c-479f-a440-b7f1f43bc5e8/sig_sauer_p226_vs_p229_size.pdf
    • http://rosipev.rf.gd/nagusel.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb22.bin
79ba26274476f7f9f4ded4def90198169f65f89b440e627912b5027e5c2cc5e5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB22 5504 bytes
font_01_sfnt_off00010dd6.bin
6ceddbb6be7c1dbb4b338d878def39d8bb543aa854520ca3235d633d54fc9c69		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10DD6 11468 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.