Malicious PDF — malware analysis report

Static analysis result for SHA-256 58955a6acdd5e93d…

MALICIOUS

PDF

212.8 KB Created: 2021-03-21 10:57:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: af4f3161809f169b78df14671ff19491 SHA-1: 655c0f75fec540438b19a36311ad69caccbbf0f5 SHA-256: 58955a6acdd5e93dfd8186d54a892fa5079d948dc9ecb6ad407cc1f3a2b1669c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing an embedded link that directs to a URL associated with phishing. The ML classifier and ClamAV detection strongly indicate malicious intent. The embedded link likely leads to a second-stage payload or a phishing page designed to harvest user credentials.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9755

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/award?keyword=eugenics+history+pdf PDF link annotation
    • https://cdn.sqhk.co/vigomuraguf/phfGoPN/fajezupivigewomuta.pdfIn PDF document text
    • https://cdn.sqhk.co/mikoduper/Rgdhb8g/zujebagijajubosizaj.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4461505/normal_5fc7cc12ec954.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376611/normal_603b64c31bcf6.pdfIn PDF document text
    • https://banatili.weebly.com/uploads/1/3/5/3/135314160/1706425.pdfIn PDF document text
    • http://ponaxamewimenul.sportsontheweb.net/13260000621.pdfIn PDF document text
    • http://dofujifeluradep.medianewsonline.com/kefoxesemedoxebeso.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454161/normal_603f13b8cbfa3.pdfIn PDF document text
    • https://cdn.sqhk.co/mogizilo/Ju5hcW7/free_slots_casino_games_to_play.pdfIn PDF document text
    • https://nalabusapigo.weebly.com/uploads/1/3/2/7/132740218/nawus.pdfIn PDF document text
    • http://fajafifog.mywebcommunity.org/30008875934.pdfIn PDF document text
    • https://cdn.sqhk.co/soxuxopova/LIjcVhc/5443966980.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4405922/normal_6056851bcc353.pdfIn PDF document text
    • https://cdn.sqhk.co/dipasupor/bryNyYi/navneet_meaning_in_gujarati.pdfIn PDF document text
    • https://digakope.weebly.com/uploads/1/3/5/9/135974251/dokug-goriwu.pdfIn PDF document text
    • http://fanuvazav.scienceontheweb.net/2808682817.pdfIn PDF document text
    • https://radinake.weebly.com/uploads/1/3/1/8/131856095/7912839.pdfIn PDF document text
    • https://wixokaregojes.weebly.com/uploads/1/3/2/6/132681478/xuvegilumevemaf.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/88fd4779-0c12-4c7c-8b6f-9c3d2e44e872/dumepofokeridufi.pdfIn PDF document text
    • http://kopuperoki.epizy.com/android_google_maps_language_settings.pdfIn PDF document text
    • http://zoripevi.rf.gd/45014463900.pdfIn PDF document text
    • http://viwefar.rf.gd/venigovofa.pdfIn PDF document text
    • http://bivojeda.atwebpages.com/piano_adventures_christmas_3a.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/23d7cabd-27bb-427c-80e3-1799060a5b34/saifurs_spoken_english_book_free_download_in_bengali.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0559e143-b2aa-4356-bb8a-c311c03dce48/jomufilunivos.pdfIn PDF document text
    • http://sumotun.rf.gd/34711760557.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/37d1a786-9a9f-4bc3-aa92-72402aa16dbd/burger_king_nutrition_grilled_chicken_sandwich.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/daf94dfb-a406-43c9-a39c-1eb7aa337b6f/kevuwenopomusuk.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002da5d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2DA5D 9008 bytes
SHA-256: dc7d565f4ae96d62c9b5e5526334931156c8c3e6912bf7e0b868791f2db01640
font_01_sfnt_off0002f76b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2F76B 5232 bytes
SHA-256: b40b4ad09d03da480c3fad527e1ff56f4285f66460fcf308913b209d301bbe6e
font_02_sfnt_off0003094c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3094C 19444 bytes
SHA-256: 0d2736b55bdb76e98e2d5a1be9105744d6a24c47d70648eebf4fd23971fa8e9c

Open this report in the interactive analyzer, or submit your own file for analysis.