Malicious PDF — malware analysis report

Static analysis result for SHA-256 5776bcad08c9ee07…

MALICIOUS

PDF

72.3 KB Created: 2021-01-18 13:50:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 5439c7e3d3c5b7d8c99a637e1087b313 SHA-1: da82a5c5758f85c98e24ab2f3973f723c5774be7 SHA-256: 5776bcad08c9ee0709e09ec5e40caca2308bf16e9f1fe5f59625f8e531bcaf94
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, indicating a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly support its malicious nature. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest it's designed to redirect users to malicious content, likely for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/wb?keyword=retro%20gamer%20206%20pdf In PDF document text
    • https://site-1201795.mozfiles.com/files/1201795/facebook_test_ads_android.pdfIn PDF document text
    • https://site-1166676.mozfiles.com/files/1166676/wipujukulinubexa.pdfIn PDF document text
    • https://site-1210823.mozfiles.com/files/1210823/43789018464.pdfIn PDF document text
    • https://site-1177442.mozfiles.com/files/1177442/wallpaper_gamers_hd_4k_black.pdfIn PDF document text
    • https://cdn.sqhk.co/xuxumududu/szyieij/zegunafedokixigobupux.pdfIn PDF document text
    • https://cdn.sqhk.co/soletibedix/hhKTjgH/restaurant_empire_kitchen_chef_food_cooking_games_free.pdfIn PDF document text
    • https://cdn.sqhk.co/lojosewude/WgBvOjb/61875138704.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/dazuxujepov/laziwuxadavakojivunogafi.pdfIn PDF document text
    • https://s3.amazonaws.com/pajukovuxetu/report_by_road_accident.pdfIn PDF document text
    • https://s3.amazonaws.com/pomaxa/rabowukirulalozatulurek.pdfIn PDF document text
    • http://nawonuzegajosi.epizy.com/37498676587.pdfIn PDF document text
    • http://tokofelutuj.epizy.com/aradhike_song_from_ambili.pdfIn PDF document text
    • http://rixuzomobe.epizy.com/jimazugirotenudafuxubav.pdfIn PDF document text
    • https://s3.amazonaws.com/jexijer/glacial_erosion_and_deposition_worksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/bejexe/carry_on_jatta_full_movie_2012.pdfIn PDF document text
    • https://s3.amazonaws.com/miwolezedubujoz/sector_imperialis_painting_guide.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d8c5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD8C5 5588 bytes
SHA-256: d22358b12dc07e8a01ecba7a65ddf8fd27fc657ab7dd2c4cfe2f3254546e829e
font_01_sfnt_off0000ebb7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEBB7 11916 bytes
SHA-256: 87587bc067442874daa5b319ed113fa5571f60fa3314bc2b3baf1678cdaef4cb

Open this report in the interactive analyzer, or submit your own file for analysis.