Malicious PDF — malware analysis report

Static analysis result for SHA-256 5adc9fad169edade…

MALICIOUS

PDF

88.5 KB Created: 2021-03-02 03:35:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17
MD5: 026a00acbc6b3fe2e20b7d637189394c SHA-1: b7de7d5ed815a0d471ce7ae78d873ef2d47c1a87 SHA-256: 5adc9fad169edade93e5ecacf10218cae4fd9c6ab21e3958c3cbca72dc87a56d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site. The document body, though heavily obfuscated, suggests a lure related to 'El principito capitulo 3'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/strik?utm_term=el+principito+capitulo+3+resumen+corto PDF link annotation
    • http://prizinsta.online/40759130924ji7m9.pdfIn PDF document text
    • http://lnstagramsupportinfo.com/basic_multivariable_calculus3uf4m.pdfIn PDF document text
    • http://yourlivehelp.com/76586461166c9ich.pdfIn PDF document text
    • http://znakomstva69.space/25680745935uisn9.pdfIn PDF document text
    • http://wijofotezopadik.medianewsonline.com/star_citizen_ships_in_game_price_3.10.pdfIn PDF document text
    • http://wezituvod.22web.org/cloudformation_template_lambda_example.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/fatikonavori/ropeterigalalixosa.pdfIn PDF document text
    • https://s3.amazonaws.com/lakujusitejojet/attestation_de_travail_template.pdfIn PDF document text
    • https://s3.amazonaws.com/jevedijadiki/68909079268.pdfIn PDF document text
    • https://s3.amazonaws.com/bulolimepol/android_box_himedia_q10_pro.pdfIn PDF document text
    • http://zetafonetupusef.epizy.com/does_dunkin_donuts_make_breakfast_sandwiches_all_day.pdfIn PDF document text
    • https://s3.amazonaws.com/divelatoxa/89569860783.pdfIn PDF document text
    • http://futikuzita.onlinewebshop.net/dell_optiplex_760_specs_motherboard.pdfIn PDF document text
    • http://fanuzisi.epizy.com/jiwudi.pdfIn PDF document text
    • http://xogonat.epizy.com/health_canada_canadian_drinking_water_quality_guidelines.pdfIn PDF document text
    • https://s3.amazonaws.com/pusolefosex/tfs_git_tutorial_for_beginners.pdfIn PDF document text
    • https://s3.amazonaws.com/lorifawuvawot/fcb_news_bleacher_report.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010e4f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10E4F 5080 bytes
SHA-256: ef4a0a17aca32a743d5de0975dfb77c2b090a15331ab5cac7ff23287608c14c8
font_01_sfnt_off00011f6c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11F6C 11560 bytes
SHA-256: a379a968e475152fcd05dcb627b79b6683464d297a43aeede4dd7cd4d5a18a4a
font_02_sfnt_off000144e5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x144E5 4324 bytes
SHA-256: 1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361

Open this report in the interactive analyzer, or submit your own file for analysis.