Malicious PDF — malware analysis report

Static analysis result for SHA-256 57941f94dea162fc…

MALICIOUS

PDF

82.4 KB Created: 2021-03-23 15:15:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4c14e77e5bf18a7873dd3104b86905cb SHA-1: 77f8cf74ba65cb01201b56234cc4751c6eb6174d SHA-256: 57941f94dea162fc537fbb555d8a812bd57322373fd2725a0dd299ea89e36ebd
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The PDF contains an external URI pointing to a suspicious domain, which is likely used to deliver a malicious payload or conduct phishing. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest it's designed to trick users into visiting a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/wix?keyword=papa+louie+3+when+sundaes+attack+unblocked+cool+math
    • http://sowipilarow.mygamesonline.org/beethoven_piano_sonata_no_17_in_d_minor_op_31_no_2.pdf
    • http://sport-stavki.fun/degapupupozowolote98c2c.pdf
    • http://nibewubixela.getenjoyment.net/47304295145.pdf
    • http://texno3ua.com/9th_class_pak_study_notes_in_urduab2ou.pdf
    • http://xulubapatoso.scienceontheweb.net/2382009898.pdf
    • http://nalodorepuwag.getenjoyment.net/leginilesojazurikudej.pdf
    • http://kevufeduwatawos.mypressonline.com/piano_sheet_music_free.pdf
    • http://magazok.top/49388908317ex4in.pdf
    • http://vugaganopofom.mypressonline.com/48631242624.pdf
    • http://kevufeduwatawos.mypressonline.com/tamezegunabaxisisifuxela.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://wonanikapudidak.atwebpages.com/libro_el_pequeo_secreto.pdf
    • https://s3.amazonaws.com/bifamomove/teamviewer_for_android.pdf
    • https://s3.amazonaws.com/kufazete/how_to_make_a_gutter_cleaner_from_a_leaf_blower.pdf
    • http://xiniwipilanaju.atwebpages.com/tododipaketuvesabagabesu.pdf
    • https://s3.amazonaws.com/laginekux/how_to_get_a_membership_to_planet_fitness.pdf
    • http://sajatuvireguta.atwebpages.com/31769787017.pdf
    • https://s3.amazonaws.com/sizabo/14385519601.pdf
    • http://womidelere.myartsonline.com/fasilazixitusuwidufox.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e2c4.bin
249b8cb3f8e8f1b3bb47097817a2bc85ba163919084afb62a47de399a8a749d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE2C4 5680 bytes
font_01_sfnt_off0000f5fd.bin
c9eb1bb941c6149af3a926b41093637ebfd65e1a4a04ffbec10a10cb0cb65b5f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF5FD 13096 bytes
font_02_sfnt_off00011fcd.bin
ae6acda62589e252b86d5d3f3c1b142725a2477d2e14b3c677b417153806a2e6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11FCD 17384 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.