Malicious PDF — malware analysis report

Static analysis result for SHA-256 549c3d7fdd500752…

MALICIOUS

PDF

76.4 KB Created: 2021-03-17 08:42:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 883469c710ac85a2edd9d643fe40728b SHA-1: 9a5b5838373541fb5e62f2ae2ee7956dc920a517 SHA-256: 549c3d7fdd5007525d878347d179766e9e4572cf1a0828912c8913c59e46dcf6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to host a malicious payload or redirect the user to a phishing site. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the presence of external URLs strongly suggests a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/award?keyword=bfs+and+dfs+in+graph+pdf
    • http://vinorama.fun/nuwalefibuje8ssgu.pdf
    • http://shoes-storie.club/99089113816bgh4y.pdf
    • https://cdn-cms.f-static.net/uploads/4422643/normal_6040206d2f34f.pdf
    • http://fullpisetc.ru/lununekewuwafb8ygi.pdf
    • http://xeeewq.xyz/26995116136dq7m.pdf
    • http://the-job.ru/7239354448ttdsb.pdf
    • https://cdn-cms.f-static.net/uploads/4463034/normal_6034916c9b552.pdf
    • http://price-list.moscow/zateremizilijetepiex8ox.pdf
    • http://evilcheats.fun/dejifipuwivjtkj4.pdf
    • http://zakewabo.scienceontheweb.net/diary_of_a_wimpy_kid_wrecking_ball_free_download.pdf
    • https://static.s123-cdn-static.com/uploads/4369663/normal_5fc5cb4b853fc.pdf
    • https://static.s123-cdn-static.com/uploads/4386822/normal_5fc644aa353c3.pdf
    • https://static.s123-cdn-static.com/uploads/4486975/normal_6007623263720.pdf
    • http://zakosemej.mypressonline.com/rofen.pdf
    • http://kunozoxutokusu.mygamesonline.org/bolens_13am762f765_manual.pdf
    • http://wijetaz.mypressonline.com/tejetujenuguxedika.pdf
    • http://tacfitproducts.com/89008483359gg440.pdf
    • http://funseeds.site/filephtyoe.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/38a95995-896f-4529-8c2b-bce71c87ef6a/tirifolurijajarut.pdf
    • https://uploads.strikinglycdn.com/files/3b77ee55-8b36-4ac5-a564-715d07e53f79/tediwepomer.pdf
    • https://uploads.strikinglycdn.com/files/79c56134-2441-4d94-b971-808cb93d2def/venuluk.pdf
    • https://uploads.strikinglycdn.com/files/f6774a1b-0b94-4d0e-ae4d-6aac792932d2/18771843498.pdf
    • https://uploads.strikinglycdn.com/files/ecd92616-d927-4f4f-b6e9-f0138d34d943/calendario_escolar_2020_minerd.pdf
    • http://wujagenak.atwebpages.com/rainer_maria_rilke_book_of_hours_love_poems_to_god.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed48.bin
f5894c784491beffeac7ebec9a23fad16209256c8fb30344018ac727d1bc01d8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED48 5320 bytes
font_01_sfnt_off0000ff66.bin
447822e69a4bd02d7abc964953880c74ec8a15c3753c048602e99c53640efbf2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF66 10640 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.