Malicious PDF — malware analysis report

Static analysis result for SHA-256 5a91f9de40450110…

MALICIOUS

PDF

86.6 KB Created: 2021-07-01 23:55:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 12d1b6f2e2358d979806646f26184bfa SHA-1: acc394519d54fc95e8e1a9f63d2105beb2e5eb37 SHA-256: 5a91f9de404501100cec05a906379b3ac96e3ab530c0f8de5c912522890c630a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of embedded URLs, specifically those pointing to potentially compromised websites hosting PDF files, suggests a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of an attempt to redirect the user to a malicious site, aligning with spearphishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9848

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.criteriainvest.com.br/wp-content/plugins/super-forms/uploads/php/files/qe0udlvsmjsqra21qb4pietmeb/89889952366.pdf
    • http://www.rolstoellift.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608634a1a2749---zumugulajazixarigon.pdf
    • https://bentzendesign.se/wp-content/plugins/formcraft/file-upload/server/content/files/16073e959e25ae---52531254533.pdf
    • https://kermoulin.com/userfiles/file/29188257567.pdf
    • https://spazmedia.com/wp-content/plugins/formcraft/file-upload/server/content/files/160726819df434---45369518964.pdf
    • https://heykidsletscook.info/wp-content/plugins/super-forms/uploads/php/files/76c3e1fcc39d86bdcfee95b00d1a675e/lilinopuxalaba.pdf
    • http://projectbudapest.hu/wp-content/plugins/formcraft/file-upload/server/content/files/1606f1700c26f0---24956107507.pdf
    • http://alliance-ltd.com/userfiles/milotamebolarasoxafalezu.pdf
    • http://www.marcado.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160ba52db47599---dulonajoma.pdf
    • http://www.misshandicap.ch/wp-content/plugins/formcraft/file-upload/server/content/files/16077b795ae895---wirepib.pdf
    • http://sosnovgeo.ru/userfiles/file/99133486027.pdf
    • http://www.nanodrywash.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c90a2832254---39382338183.pdf
    • https://tonwen.org/userfiles/file/52196254691.pdf
    • https://dubaimotorcycletours.com/uploaded_images/files/gupakudesipejag.pdf
    • http://www.kidnuri.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607a53483d952---97200661061.pdf
    • https://binhruamuinanobac.com/wp-content/plugins/super-forms/uploads/php/files/99h28n5jfl2j1q9ddci674g1da/24182009272.pdf
    • http://copy2d.com/ftp/image/file/10838939943.pdf
    • http://onlinetradeshow.ir/uploads/files/rediromuf.pdf
    • https://centrosteadycam.it/wp-content/plugins/super-forms/uploads/php/files/e6a9f5d475accf747a57b0e04bf29389/14169483995.pdf
    • http://vaness-sens.fr/ckfinder/userfiles/files/55575644554.pdf
    • https://www.reliancecareuk.com/wp-content/plugins/super-forms/uploads/php/files/bf74786334c21d9758aae8950801bf24/zufuv.pdf
    • https://eduinfinite.com/wp-content/plugins/super-forms/uploads/php/files/5455e6d7d39f316d40bd383f6ad2bd3c/rusutiwedetubafagu.pdf
    • https://myupfield.link/wp-content/plugins/super-forms/uploads/php/files/qfm3ec1upf81c3vhco5g0q4dho/gedoxorid.pdf
    • https://csom.cz/wp-content/plugins/super-forms/uploads/php/files/4aca5f89c94be3351795c960551a25b0/wowukikazedumexixato.pdf
    • http://visualpaint.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c3267d7024c---kusezuz.pdf
    • http://indecomavo.pl/inc/bopukoxezazafojoniget.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/6naE_Nh8_CY/uplcv?utm_term=explain+dry+sump+lubrication+system
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f11c.bin
6f67fe8cd9dbdbc9435ecb763593d6ec74c9536c2b7d43f0f0dad8c154a5aecb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF11C 16344 bytes
font_01_sfnt_off00011b2c.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11B2C 16792 bytes
font_02_sfnt_off00013343.bin
979e04302d4d1d86628a94baaef33a9fe23ebf9cb68252866d992d4243e314a2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13343 11116 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.