Malicious PDF — malware analysis report

Static analysis result for SHA-256 5951b9d72121f32a…

MALICIOUS

PDF

8.0 KB Created: 2021-10-16 09:53:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-02
MD5: 5ec5233ec8ce478720fa5ad44a50c88d SHA-1: 33a621d475b71ccd388fc9c9a8b8b74e62708280 SHA-256: 5951b9d72121f32a7342ad567734d5ea3646ef7a47a1184ea1c2b5823fd4af4f
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file is identified as an image-only lure, typical of phishing attacks, with a high-confidence heuristic indicating a deceptive host link. The embedded URL, http://yughdlglmelpeper.updta78-serv1ce.info, is the primary indicator of malicious intent. While no scripts were explicitly extracted, the PDF structure itself facilitates the redirection to this malicious domain, likely for credential harvesting or malware delivery.

Machine Learning

  • Nyx PDF Classifier clean score 0.1816

Heuristics 4

  • Image-only PDF lure links to a deceptive (typosquat) host high PDF_IMAGE_LURE_DECEPTIVE_HOST_LINK
    PDF is image-heavy with little real text and its clickable action targets a host that impersonates a security/service/brand word with a look-alike homoglyph substitution — a digit OR a confusable letter (e.g. 'serv1ce', 'servlce', 'upd4te', 'm1cr0s0ft') — on a domain that is not a known-good site. This is a credential-phishing / fake-update carrier shape: a screenshot-like page funnels the victim to a deceptive look-alike destination.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 8 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://yughdlglmelpeper.updta78-serv1ce.info PDF link annotation
    • http://www.microsoft.com/typography/ctfontshttp://www.munchfonts.comMicrosoftIn PDF document text
    • http://www.microsoft.com/typography/fonts/default.aspxIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000126c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x126C 5084 bytes
SHA-256: f95d40e2950ea552301c19853b6c40df18764d1bbd6f5fa51849987c321f350a

Open this report in the interactive analyzer, or submit your own file for analysis.