Malicious PDF — malware analysis report

Static analysis result for SHA-256 5363d275e0098131…

MALICIOUS

PDF

65.9 KB Created: 2021-05-29 16:26:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1a5599ae91536520572e3b496817247a SHA-1: d30d298bfaee43b6969a75ddaa24a4e7bb288177 SHA-256: 5363d275e00981318bb04a5e1013b33ca984372dfb002439b844f94b92bb5ca0
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains numerous embedded URLs pointing to PDF files hosted on various compromised websites, suggesting a phishing campaign. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and 'npv calculation', which could be part of a lure to trick users into downloading the malicious PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.grupohk.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16079348647aff---topipomu.pdf
    • https://enville.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608780ad01add---dozavu.pdf
    • http://bike-aholic.com/UserFiles/file/55546807042.pdf
    • https://www.cukoyem.com.tr/wp-content/plugins/super-forms/uploads/php/files/d3lr1t14tr54fff4l71cb627u1/dupadofevaxoxuf.pdf
    • https://www.peeryhotel.com/wp-content/plugins/super-forms/uploads/php/files/ed2acf1a7d0ce3daade5236a306ae493/lalug.pdf
    • http://relocationservicesgroup.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d5d1e087f9---sojobebolufejosivasojopop.pdf
    • https://dfa-finanz.de/wp-content/plugins/formcraft/file-upload/server/content/files/16075a7dbb0696---39233848031.pdf
    • https://backcountryplayground.com/wp-content/plugins/super-forms/uploads/php/files/2e0053a3f09fc8344155c93788652d58/73397692274.pdf
    • http://kwik-it.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1609c416545ec8---91152500751.pdf
    • https://freedomhypnosisnyc.com/wp-content/plugins/super-forms/uploads/php/files/5d848e70ccce4ae823fa777dfb30b00e/wigekagabazu.pdf
    • https://fortlauderdale-carservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607e2c88029c7---64379587236.pdf
    • http://yuha.be/_files/file/baratuzefanemawazakimir.pdf
    • http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/16090ee0585133---kekaze.pdf
    • https://frennphotography.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d5250745e7---xogizosuxopame.pdf
    • https://maidintown.co.uk/wp-content/plugins/super-forms/uploads/php/files/6e1ad69b5c2163d7a8a38c5916d6cf72/78998596645.pdf
    • http://villaturri.it/wp-content/plugins/formcraft/file-upload/server/content/files/160a8071a9bf84---55629428434.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/S30rS-6n6vg/uplcv?utm_term=how+to+npv+calculation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c9db.bin
52b7c3e8458fea9fef01e395113d1c096aa59bbc7e3446862053af2d1bc502a8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC9DB 4768 bytes
font_01_sfnt_off0000da3b.bin
5d7bfca9ab07ef9e1ed4af972876dc884fafaeb00d30ddf7dea9f866ae7bc005		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDA3B 9564 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.