Malicious PDF — malware analysis report

Static analysis result for SHA-256 57aa03876ce1f95f…

MALICIOUS

PDF

79.4 KB Created: 2021-07-14 01:14:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-05
MD5: dd51455e173d5b6af4f1972e9bcd5a81 SHA-1: 5abe99997e527902288b3513a54071e978972a30 SHA-256: 57aa03876ce1f95f88b9d1725f7559958cfc7884b0091da4471c575762e6fc3f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. The presence of embedded URLs suggests a phishing or credential harvesting attempt, likely delivered as a spearphishing attachment. No scripts were extracted, but the overall detection profile points to a trojan designed for phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/razvivatel/yapz/~3/UZrB20b2Dcg/square?utm_term=names+for+twins+boy+and+girl+that+rhyme PDF link annotation
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60ee038dc6126f45c3e600bb/1626211213676/21355005362.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60ee0e56537273346e2bda6e/1626213974382/1654189003.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60edfee68f209f4d828764d5/1626210022275/changing_your_last_name_in_ontario.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60edfdeead58ca03d22a285f/1626209774407/nelly_dean_wuthering_heights.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e965dc66be7e490f11b594/1625908700304/do_i_need_a_front_license_plate_in_texas.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e95695b132fa36207519be/1625904789506/50583727435.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60e9477a309bd63f3d873174/1625900922602/26384221284.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60ec7ab27a1add4dee1eb984/1626110642209/94047166952.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e7fd4257d2352c927dc133/1625816386672/78513748761.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ee105702e0767984f01890/1626214487389/63636430543.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60e89dd094d6cc18f19f44d0/1625857488798/papebekirevukabilage.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d457.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD457 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000ec6e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC6E 11120 bytes
SHA-256: 19bf89f69b3e7c096bef27c73a7cadc8b6c220831028496277954d14167ef2ec
font_02_sfnt_off00010602.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10602 16568 bytes
SHA-256: 5e53f52f630dfac6cf2eaa090d3649b2c4f2fd72461da2bdb857e5687a2a09a4

Open this report in the interactive analyzer, or submit your own file for analysis.