Malicious PDF — malware analysis report

Static analysis result for SHA-256 56a05a0ba9f9e1d1…

MALICIOUS

PDF

81.2 KB Created: 2021-03-15 15:50:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: c51485c949c30fdc4f21b1403d306ba9 SHA-1: df931fbc55f7d3f90887789819e6349c1fc202ce SHA-256: 56a05a0ba9f9e1d161ea3d24caa773ab8ea45903e67dbbdfb15aed4844ffc25c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=what+are+the+8+figurative+language PDF link annotation
    • http://konsalting.info/dale_carnegie_how_to_win_friends_and_influence_review3he21.pdfIn PDF document text
    • http://mebosopevux.iblogger.org/64313202127.pdfIn PDF document text
    • http://chempion.coffee/1379652067k8bmo.pdfIn PDF document text
    • http://xexevigaje.22web.org/bad_genius_movie_mkv.pdfIn PDF document text
    • http://smartcreditscore.info/aircraft_performance_and_designb8rqi.pdfIn PDF document text
    • http://8gusevshop.space/poweraudio_pro_music_player_reviewi2ktk.pdfIn PDF document text
    • http://smartycredit.info/distinguish_between_essential_and_natural_boundary_conditionsaubrd.pdfIn PDF document text
    • http://kukushka.space/redlands_primary_school_worksop_ofsted_reportkak83.pdfIn PDF document text
    • http://cocobeautybar.ca/prepositional_phrase_worksheets_5th_grade_free2272w.pdfIn PDF document text
    • http://egosikenclub.com/wills_eye_manual_8th_edition_download8eg2g.pdfIn PDF document text
    • http://e-devletodeme.net/785981033629h2mk.pdfIn PDF document text
    • http://usesalle.xyz/jujezisomapajud8xi5d.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://2a085669-a8dc-40eb-b1d3-71ea9d660f60.filesusr.com/ugd/cafc24_1902f3b4589048d88815c302339404e8.pdf?index=trueIn PDF document text
    • https://ac263381-fdad-4fda-ae78-6df6d71032d6.filesusr.com/ugd/25c42e_e0b2261161ba48d780eff5040931acbd.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/mefadedosuw/street_fighting_2_ko_fighters_mod_apk.pdfIn PDF document text
    • http://wivoruremuwun.rf.gd/5_types_of_personal_stressors.pdfIn PDF document text
    • https://s3.amazonaws.com/devuxuzejozam/carbon_cycle_worksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/gitipelut/daddy_s_home_parent_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/jazamerijekufol/8874138563.pdfIn PDF document text
    • http://gogejovuxog.epizy.com/kemasupapusopuvigif.pdfIn PDF document text
    • https://s3.amazonaws.com/nabifovu/safipapalovuda.pdfIn PDF document text
    • https://s3.amazonaws.com/kexamoxusinixu/99874294440.pdfIn PDF document text
    • http://suziwifu.rf.gd/50934181866.pdfIn PDF document text
    • https://s3.amazonaws.com/toguvaju/59750082809.pdfIn PDF document text
    • https://2061f665-9309-41a6-981d-137229ee7e60.filesusr.com/ugd/eb2fe6_4b278bd9d4454751bccaa16a6c1a30ad.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ff2f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF2F 5120 bytes
SHA-256: b0b3a504408406a082a6177d7f43bc5a4b351117be52ebda7d11f670b135256f
font_01_sfnt_off000110aa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x110AA 11268 bytes
SHA-256: 86f78eb06ef0bf285c0f744b7ccb3a28bbdb350cabc9877d1d9151fd110e64be

Open this report in the interactive analyzer, or submit your own file for analysis.