Malicious PDF — malware analysis report

Static analysis result for SHA-256 540cdd4798f7acc4…

MALICIOUS

PDF

91.4 KB Created: 2021-03-13 16:33:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: edb976dcbfe9b3b2c095419790f3e1d4 SHA-1: dd46960eeeda4592b3ebe95d5328db69e13cd87b SHA-256: 540cdd4798f7acc42692b4ad20bfc0524b789bb988d5eae8c3e81bca1ce0d922
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that mimics a search result for a specific product, likely intended to trick users into visiting a malicious site. ClamAV detection and ML classification strongly indicate malicious intent, consistent with a phishing or malware distribution campaign. No scripts were extracted, but the presence of external URIs suggests the document's primary function is to redirect the user to a potentially harmful resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=dell+u2715h+max+resolution
    • https://cdn.sqhk.co/sigidezok/5vgjqGS/jegifepuvinijagogotivijev.pdf
    • https://cdn.sqhk.co/lojosewude/tnYjbty/buttercream_icing_recipe_for_cake_decorating_with_shortening.pdf
    • https://wuwiragirek.weebly.com/uploads/1/3/0/8/130874366/8355541.pdf
    • https://lijipowurop.weebly.com/uploads/1/3/4/3/134314174/pofuwisovo_buvuraki_juruwo_wigegexowani.pdf
    • https://cdn.sqhk.co/pixafosabow/ihhcyFy/lightroom_color_grading_tutorial.pdf
    • https://tobisimotar.weebly.com/uploads/1/3/5/3/135330661/lajoramoku_pafotetonijabid.pdf
    • http://pefiworawodud.mypressonline.com/saheeh_international_quran_arabic_text_and_english_translation.pdf
    • https://fojiwuduz.weebly.com/uploads/1/3/5/3/135309278/5489349.pdf
    • https://static.s123-cdn-static.com/uploads/4384463/normal_5ff28efa77ff9.pdf
    • https://cdn.sqhk.co/kitaparek/SyhfBge/sniper_full_movie_2016.pdf
    • https://static.s123-cdn-static.com/uploads/4451955/normal_5fdd0c54423a8.pdf
    • https://cdn-cms.f-static.net/uploads/4403131/normal_6049773668ec4.pdf
    • https://sejiganabukuja.weebly.com/uploads/1/3/4/5/134585043/gubakijalodafapev.pdf
    • https://cdn-cms.f-static.net/uploads/4476954/normal_60290c781059d.pdf
    • https://xisuviwilizej.weebly.com/uploads/1/3/4/3/134320176/bebuvagazizidugegu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/10866272-8e6d-40fc-9a16-30a9d0929753/wordly_wise_3000_book_6_lesson_3_test.pdf
    • http://vuxebezedigelun.onlinewebshop.net/madukinutezamotuvotates.pdf
    • http://jibimom.myartsonline.com/lewevurinurewelum.pdf
    • https://uploads.strikinglycdn.com/files/d259937e-c8c5-426d-b624-8d1967bbf2ed/kasivukeloteko.pdf
    • https://uploads.strikinglycdn.com/files/cb8b8ad6-66af-4d41-b64a-099041ddf0d0/nugerodaxinurikubutuvogow.pdf
    • https://uploads.strikinglycdn.com/files/2ecdb372-82fc-483e-9b88-66995ad1c1a7/child_of_god_hill_song_lyrics.pdf
    • https://uploads.strikinglycdn.com/files/c46a35f7-4674-4da0-a39d-988fd1a04754/how_to_pair_big_blue_unplugged.pdf
    • http://mifotabelimudon.myartsonline.com/maxezavimu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000123f9.bin
8105379947877aa886bea486fe761d9beaa7db3e3891e004f5115ceb4a0b80d2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x123F9 5380 bytes
font_01_sfnt_off00013628.bin
68444977f0c2a49330822c66fb6a90b0f93ddd1eaf24d1e36f023197ecfe3653		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13628 11820 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.