Malicious PDF — malware analysis report

Static analysis result for SHA-256 59101fd3841f9f27…

MALICIOUS

PDF

78.7 KB Created: 2021-03-21 08:20:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4ec4f3f129cfac181a5e9c227671bafa SHA-1: 75f78d4c724853899160bf339f3d9fc42079dc5f SHA-256: 59101fd3841f9f27ad8eb6374e55fa687c881093ddc377c8648abfafb09c6182
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site. The document body, though heavily obfuscated, appears to be a lure related to search terms, reinforcing the phishing pretext.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=transcendental+meditation+courses+near+me
    • http://clebohets.xyz/80592591439098vc.pdf
    • http://lnstagram-copyright-confirms.com/342496321074npwd.pdf
    • http://simultaneously.space/dobepazuworji486.pdf
    • http://ericksandoval.com/joe_cocker_feelin_alright_piano_sheet_music5vl2c.pdf
    • http://kersita.fun/fender_champion_40_review_youtubebytlm.pdf
    • http://creamwalls.online/is_ghost_gonna_be_in_power_book_25cm7e.pdf
    • http://tixshopclub.fun/playstation_vita_games_for_sale04xkm.pdf
    • http://abistrans.ru/universal_audio_apollo_twin_mkii_duo_manualyvvx4.pdf
    • http://reestr.site/pamarirj2uu.pdf
    • http://vovality.club/mike_v_skateboard_party_pro_apkpurep9xmw.pdf
    • http://amsidisi.xyz/how_to_change_first_alert_carbon_monoxide_detector_batterygze9i.pdf
    • http://9gusevshop.space/sosodolelyv50n.pdf
    • http://about-central.com/26100716777ao75n.pdf
    • http://look-hotel.com/tuzatemodejogutevoow9ct.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/kefefetafij/cva_wolf_209_magnum_outfit.pdf
    • http://wotidupodugi.myartsonline.com/cuantos_centimetros_son_5_pies_y_4_pulgadas.pdf
    • https://s3.amazonaws.com/resixexi/how_to_do_3nf_decomposition.pdf
    • http://sukokovevaz.atwebpages.com/atoms_and_molecules_class_9_questions_and_answers.pdf
    • https://s3.amazonaws.com/zerejibixupav/sarigetorizofakunezukolu.pdf
    • https://s3.amazonaws.com/kumasala/allegory_of_the_cave_questions_and_answers.pdf
    • https://s3.amazonaws.com/tesotiwapax/78750880506.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f243.bin
21cc72552e0f2969ed1ec8df7ba302bba9619074d671c0570c0dc78afea62444		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF243 5032 bytes
font_01_sfnt_off00010345.bin
7eb8ee876c0573dd90ecb801ea5b665f11aa9ce81a600fba00938a6658832076		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10345 13608 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.