Malicious PDF — malware analysis report

Static analysis result for SHA-256 54884e818103fcef…

MALICIOUS

PDF

77.6 KB Created: 2021-03-22 07:02:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: f4b71374ef3315f345df233bb84e87c1 SHA-1: 1d8a1b46b65c8e3deca50a49842aa29446d82920 SHA-256: 54884e818103fcefee72c6f2daf8a0957a83f3f1bd14d2827c5d57e0899a54d8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/strik?utm_term=are+everlast+shoes+any+good PDF link annotation
    • https://cdn.sqhk.co/joxutedunik/hfVCNiQ/pvp_iv_calculator_shadow.pdfIn PDF document text
    • http://nogurufegu.mygamesonline.org/best_biology_notes_for_ssc_cgl.pdfIn PDF document text
    • http://kuzexamipapoxip.medianewsonline.com/nutrition_facts_taco_bell_bean_burrito_no_cheese.pdfIn PDF document text
    • https://cdn.sqhk.co/risenulowo/Lheenmc/60th_birthday_party_theme_ideas_for_mom.pdfIn PDF document text
    • http://pugisapi.mypressonline.com/modefus.pdfIn PDF document text
    • http://moreprodukti.com/the_dragon_prince_season_3_episode_6_watch_onlineuovxb.pdfIn PDF document text
    • http://helplnstagramcontact6088757.com/my_hero_academia_season_1_episode_3_anime_planetedv2f.pdfIn PDF document text
    • http://sale50.pro/81044045589inmkb.pdfIn PDF document text
    • https://cdn.sqhk.co/dosojegomugu/yh6ifja/crossword_puzzle_generator_with_answer_key.pdfIn PDF document text
    • http://wspring.space/no_crop_for_instagramjdae6.pdfIn PDF document text
    • https://cdn.sqhk.co/niporatibu/gjbyjji/48808038132.pdfIn PDF document text
    • https://cdn.sqhk.co/rotuzuwibi/gtgdyie/sojidejawasima.pdfIn PDF document text
    • http://pravagims.net/fabalebuxohwq7.pdfIn PDF document text
    • http://rikafitamedad.medianewsonline.com/how_many_calories_are_in_a_krispy_kreme_original_glazed_donut.pdfIn PDF document text
    • http://jerabigemoz.sportsontheweb.net/cs_forester_the_general.pdfIn PDF document text
    • http://jokegave.mywebcommunity.org/bio_data_format_for_job_download.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/sukedil/83280304654.pdfIn PDF document text
    • https://s3.amazonaws.com/gazijewevan/bibogipigorixexuvameka.pdfIn PDF document text
    • https://s3.amazonaws.com/bifadiwuwileji/ruins_of_azlant_book_2.pdfIn PDF document text
    • https://s3.amazonaws.com/wisuw/tactical_rpg_card_games_android.pdfIn PDF document text
    • https://s3.amazonaws.com/rizijubovapuk/22269902413.pdfIn PDF document text
    • http://donijexufenu.onlinewebshop.net/61190531088.pdfIn PDF document text
    • http://dirulibas.onlinewebshop.net/how_to_change_a_kitchen_faucet_aerator.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f184.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF184 5236 bytes
SHA-256: 81f224b1f98517b095b14fb9eec21d9fbff3be03e594ceb301ef4e43254e5a0b
font_01_sfnt_off00010359.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10359 11028 bytes
SHA-256: 4f3a08f7b2bbdaae7349289cce1098be2b4bd7d6dcee80e6f9d388df7f7e1a73

Open this report in the interactive analyzer, or submit your own file for analysis.