Malicious PDF — malware analysis report

Static analysis result for SHA-256 55168e7b8494903f…

MALICIOUS

PDF

88.2 KB Created: 2021-03-19 18:52:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9d6fc945f0d8f131ebe38f1257a362d3 SHA-1: be148868512bd10d292f8b1196f94a3d61d573b6 SHA-256: 55168e7b8494903fbdba6bc6319e5f26c99452da4a8b49c4285bb80b93f64781
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple suspicious links, with one explicitly noted as an invisible link to a suspicious domain. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware distribution. The document's content, though heavily obfuscated, appears to be a lure for a free download, aligning with common social engineering tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-heavy PDF with invisible link to suspicious domain high PDF_SUSPICIOUS_LINK_LURE
    PDF is a small image-heavy lure with invisible link annotations that send the user to a suspicious high-risk-domain URI. This matches credential-phishing carriers where the visible document is only a prompt and the real collection flow happens on the linked website.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/award?keyword=anesthesia+made+easy+jeff+steiner+pdf+free+download
    • http://pumba-timon.space/agric_loan_formfakdk.pdf
    • http://newuwedeza.mypressonline.com/60322011754.pdf
    • http://daddytestit.xyz/giguzizubisorod6v4dw.pdf
    • http://lasleymarkt.ru/6663777736ptp46.pdf
    • http://trackengine.host/fezizoxldi08.pdf
    • http://123dutch.com/matematicas_1_eso_sm_saviaejrj6.pdf
    • https://cdn.sqhk.co/doparibi/jelFIhi/gizujuxisim.pdf
    • https://cdn.sqhk.co/sebidurubuze/gh5Lqfg/gbcc_rochester_nh.pdf
    • http://jabilevij.mypressonline.com/why_isnt_my_mini_sewing_machine_stitching.pdf
    • http://gemofesane.medianewsonline.com/cessna_182_parts_catalog.pdf
    • http://rebelliona.online/fegowatefefakakorivii4sfp.pdf
    • http://lnstagram-support.live/la_estructura_del_texto_informativo_esuaiu9.pdf
    • http://boost-shop.xyz/maxeferulekalojokagogrdw8b.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/55f966bb-c96e-43d8-a566-58c7d119d235/microsoft_excel_2016_tutorial_download.pdf
    • https://uploads.strikinglycdn.com/files/4860a9f8-f5d7-48cc-863f-04eeab693247/winumamoxefurezubenal.pdf
    • https://uploads.strikinglycdn.com/files/40b6f00c-ac91-4574-a9fc-3fceddf7f3be/how_to_thread_a_brother_sewing_machine_lx3817.pdf
    • http://jezevenakos.myartsonline.com/nerve_growth_factor.pdf
    • https://s3.amazonaws.com/dexodekelaseki/monday_punday_answers_424.pdf
    • https://uploads.strikinglycdn.com/files/f0e4ee4c-7861-426d-9db4-3b8c3d4c33b4/xorugudisexakopa.pdf
    • https://s3.amazonaws.com/webipejonavuv/scala_rider_packtalk_installation_guide.pdf
    • https://s3.amazonaws.com/silubebebefuju/70053058138.pdf
    • https://s3.amazonaws.com/batoragubukepo/ecclesiastical_insurance_group_plc_annual_report.pdf
    • https://uploads.strikinglycdn.com/files/24d63a2b-c995-4e56-b173-58eb928cce44/ditavebikaxowiweton.pdf
    • https://s3.amazonaws.com/zuses/yokogawa_centum_vp_manual.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010f95.bin
fec956f117d8725d2dd9db8d8551bd21e2add211a2c367988e154885a589dbaa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10F95 5540 bytes
font_01_sfnt_off0001225f.bin
b285f33fa0a2bc22908890ddd7b7bf10e71ab184cbd0acfe59f3ca4de8243431		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1225F 14876 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.