Malicious PDF — malware analysis report

Static analysis result for SHA-256 52eab08d35499e78…

MALICIOUS

PDF

75.4 KB Created: 2021-03-17 02:09:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 334b879382969f7c2e2e6d8e3401ca12 SHA-1: 8efcb85e211b4930369427ac7b2df2af491caf67 SHA-256: 52eab08d35499e78515510cf592c3cc45081f68a99b00c8e1933c8bf5c502a6e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site for further exploitation. The document body, though heavily obfuscated, contains keywords related to AutoCAD blocks, suggesting a lure to trick users into downloading or accessing malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/123?utm_term=autocad+dynamic+door+block
    • http://swiss-gear-top.xyz/3065395851pxoqt.pdf
    • https://cdn-cms.f-static.net/uploads/4387817/normal_5fd2ac9573194.pdf
    • https://cdn-cms.f-static.net/uploads/4375203/normal_5fd3b4472aca7.pdf
    • https://cdn.sqhk.co/lokuwanij/gjcajgP/49233784860.pdf
    • https://cdn.sqhk.co/jabezoxujo/jlhh6id/16791446379.pdf
    • https://cdn.sqhk.co/femokuxajuz/hoSFkGf/mejifopaji.pdf
    • https://cdn.sqhk.co/xaranoraf/s3hgicE/17783278484.pdf
    • https://static.s123-cdn-static.com/uploads/4389384/normal_5ffddf4cd1877.pdf
    • https://cdn.sqhk.co/xonipavu/U3M4egc/4588606105.pdf
    • https://cdn.sqhk.co/xuxozowaki/y0jbYgi/the_ordinary_matrixyl_benefits.pdf
    • http://strongcreditscore.info/soundseeder_hack_apk4zl64.pdf
    • http://shoop-fe.ru/vampires_werewolves_and_demons_supernatural_guidesn2wyy.pdf
    • https://static.s123-cdn-static.com/uploads/4460447/normal_5fcaf7238618d.pdf
    • https://cdn.sqhk.co/vekuperik/dhdhaie/67013811196.pdf
    • http://reduslimitaly.website/android_room_migration_drop_tablescobp.pdf
    • http://krokoboko3.xyz/the_elements_of_user_experience_user-centered_design_for_the_web_and_beyond_download1rbg0.pdf
    • https://cdn.sqhk.co/letonolomo/hjdhdUU/71657313420.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/380a6bb6-0030-4692-9bd5-c2ff015cccf0/no_logon_servers_available_server_2012.pdf
    • https://uploads.strikinglycdn.com/files/053e05ec-cbf0-428a-85d1-b29d5ad6c327/62862552959.pdf
    • https://uploads.strikinglycdn.com/files/308442d9-219b-4a58-96b3-afe0c8d2f36b/what_does_beast_from_water_mean_in_lord_of_the_flies.pdf
    • https://uploads.strikinglycdn.com/files/5f182e8f-503d-4a5b-8556-3a922643de47/adding_and_subtracting_fractions_with_integers_worksheets.pdf
    • https://uploads.strikinglycdn.com/files/52116192-a7f4-489e-ab87-4d08164b61e2/klipsch_promedia_2.1_thx_bluetooth_adapter.pdf
    • https://uploads.strikinglycdn.com/files/963f767a-5e28-4cef-8348-13226ac85e53/kutaxojat.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea99.bin
1fc7a055fc92cd11ae6162210fed6c64a8501f997ad55114a4a57c295505953e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA99 5200 bytes
font_01_sfnt_off0000fc41.bin
580b713d2d0f58bc2efae474dd2ccab646a32e6d2a26d0a63b131d75222f3e4f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC41 10584 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.