Malicious PDF — malware analysis report

Static analysis result for SHA-256 558686770c2207cd…

MALICIOUS

PDF

93.8 KB Created: 2021-03-27 23:16:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ab18a620ce387fc5c60e3a9c7474e68b SHA-1: 8f28cb23466ef66a97523649d1bed88d887a7b68 SHA-256: 558686770c2207cd54003e10c2b860246f3cec790aa54e49319f32b5a29daab5
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, which is a strong indicator of a phishing or malware distribution attempt. The ML classifier and ClamAV detection further confirm its malicious nature. The document body, though heavily obfuscated, appears to be a lure related to a specific book title, suggesting a targeted social engineering approach.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/award?keyword=atkins+de+paula+physical+chemistry+10e+pdf
    • https://cdn.sqhk.co/rawerusiwala/jfA3hhd/lewewimofalor.pdf
    • http://donbetosstreettacos.com/31255322650vtfwe.pdf
    • https://cdn.sqhk.co/kuzaxepigi/hAijRhg/nerexejetekenixovodajira.pdf
    • https://cdn.sqhk.co/gubujurit/6rjUEQX/pubg_mobile_metro_royale_download_android.pdf
    • https://cdn.sqhk.co/vuvapolaxaj/A41QjjR/best_chopin_famous_classical_music_piano_for_studying.pdf
    • https://cdn.sqhk.co/fikalibumi/iiiaeji/pajesolugeribo.pdf
    • https://cdn.sqhk.co/tipefima/hbhjLAL/62176267880.pdf
    • https://cdn.sqhk.co/tetaxekumipi/jiggJHP/kakobeniroluwokikinakafar.pdf
    • http://idealslim-italiaoficial.site/river_flows_in_you_piano_chordsqwadr.pdf
    • https://cdn.sqhk.co/batumozi/7jbkMja/81661070759.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/bce9fc41-c3b5-44a3-a511-615e8018b35d/control_systems_engineering_6th_edition_solution_manual.pdf
    • https://s3.amazonaws.com/risalenefazozo/30803477776.pdf
    • https://s3.amazonaws.com/negonanopix/blender_2._8_free_for_windows_10.pdf
    • https://uploads.strikinglycdn.com/files/d5f83dd0-ce5b-4cfa-aada-ea13f6284f93/the_adventures_of_sherlock_holmes_tv_series_season_1.pdf
    • https://s3.amazonaws.com/mufukep/59473061358.pdf
    • https://uploads.strikinglycdn.com/files/941b6ad5-d405-42bd-b894-a321dc3809f9/i_am_david_allen.pdf
    • https://uploads.strikinglycdn.com/files/325823c7-6c5f-4b88-9aae-2427f1f4c0a9/61261982932.pdf
    • https://uploads.strikinglycdn.com/files/c3d5666c-451c-4bc8-ad1f-99f822b9aff9/planes_y_programas_2011_secundaria_artes_musica.pdf
    • https://s3.amazonaws.com/megujobemegor/what_cable_do_i_need_to_connect_my_garmin_to_my_computer.pdf
    • https://uploads.strikinglycdn.com/files/fd5c0d18-f269-4e98-8a86-33fc2cf9bbd0/dorikokalerodulake.pdf
    • https://uploads.strikinglycdn.com/files/e8c4a3b5-0e83-46d4-b845-6a7d5cfff34c/is_shiro_fujimoto_death.pdf
    • https://uploads.strikinglycdn.com/files/3ecf2a78-5a3c-43f8-b576-e4883aa225fd/lutowukozanobere.pdf
    • https://uploads.strikinglycdn.com/files/a9f8da76-d42d-4647-8b99-9375b79c757a/how_heavy_is_a_valley_pool_table.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010e96.bin
0ecf6493aced9abc464d9d511f52389062d9c94775df2b88bf624721d6a97d20		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E96 5744 bytes
font_01_sfnt_off00012204.bin
cfc377db11de7c32928d38f5d224fcbbdd1a534bdb221cefe528c8416155e4cd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12204 2256 bytes
font_02_sfnt_off00012b8e.bin
f9a2573ff819c809b5a30d9e537f5e0fdb609671f77af7b2be49cfd973768d99		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12B8E 11708 bytes
font_03_sfnt_off000153ef.bin
e7273338525a866f49bd556f13a0e46ce1e8513f85f175d9d987aa1f8b89adb9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x153EF 16068 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.