Malicious PDF — malware analysis report

Static analysis result for SHA-256 580c70ecff56ef66…

MALICIOUS

PDF

84.7 KB Created: 2021-03-18 23:48:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e14142c7fc728ccef082f3808de74d46 SHA-1: 69f080202c061a7d3229cbe3f5a372dc5d0c8983 SHA-256: 580c70ecff56ef66be90d63b9667b76fee964c370d605c9a3c68fc2df09e283e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL points to a suspicious domain, suggesting a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and the presence of external URIs are common in phishing lures.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/123?utm_term=in+between+the+sheets+meaning
    • http://8bitbeardsco.com/vesukvo8o1.pdf
    • https://cdn.sqhk.co/modonasuje/Ehgoijh/teleport_as_a_noun.pdf
    • http://tradebot.space/curso_saboaria_natural_cold_processpt6q2.pdf
    • http://ferafukapawap.scienceontheweb.net/how_to_train_your_dragon_3_ending_explained.pdf
    • http://carishr.com/loruvutowapezutawijatuzerrgdh0.pdf
    • https://cdn.sqhk.co/ketifoseja/MR9ifgf/tagugowawuxodafapo.pdf
    • http://manovina.mypressonline.com/boy_names_meaning_son_of_god.pdf
    • https://cdn.sqhk.co/womawuxinuge/awieVij/jikodajekofivana.pdf
    • http://obsluzhivanie-kompyuterov.moscow/la_la_land_epilogue_advanced_piano_sheet_musicgfg36.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://44407f20-7244-4107-9544-84d8151b6f9a.filesusr.com/ugd/8508de_fccbab1ef5f94cc493dc4877f43c722a.pdf?index=true
    • https://uploads.strikinglycdn.com/files/d316d33f-aa9e-430f-9035-8a3d6d4dd600/how_to_fix_slow_download_speed_on_blizzard.pdf
    • https://uploads.strikinglycdn.com/files/fed04327-8eb5-4314-9878-7db45218783e/zoled.pdf
    • https://9042e326-c85f-44e6-b9b6-0c206471fdba.filesusr.com/ugd/0d2fda_69388cad5ad344f6b9df893cfb534efa.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3bb88b9f-d81e-4441-86ab-dd7835f19a33/xebuxogavinolazujonekaz.pdf
    • https://c6de0af5-2a4c-46da-924c-839bccb102c6.filesusr.com/ugd/5f1f0f_755e9ca46a3d4d30aad6c6bb1417d122.pdf?index=true
    • http://petojijoxura.onlinewebshop.net/how_do_you_clear_error_codes_on_samsung_refrigerator.pdf
    • https://2ed821ec-8078-4e74-b11b-c5cec6a88262.filesusr.com/ugd/65e777_6e4637fbbef0440d951dc05af9e5ed99.pdf?index=true
    • https://d7b50aa0-fea3-4edc-ba9e-4ed0094b0c60.filesusr.com/ugd/7f614e_7536e384ac6d451d8ed804ad89faaedd.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ee912cd4-ac93-4585-a56e-24085baa64d8/what_is_another_word_for_a_few_steps_away.pdf
    • https://28932ed2-21d9-4123-99cb-fcff0aac4472.filesusr.com/ugd/cc089a_d2b19307374049a387febf0f79a746e8.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010c85.bin
4aac1637904938eb6a867cc4b70f72c132d5aebef9193de6c371f24504ca0d3c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10C85 5140 bytes
font_01_sfnt_off00011dee.bin
9cd4e71cb61d0aa4e83e94b9a5dcb7d919165e9b9fadd4ef4c18c2e81d92b87f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11DEE 11084 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.