Malicious PDF — malware analysis report

Static analysis result for SHA-256 5c6f37b46366d02f…

MALICIOUS

PDF

74.8 KB Created: 2021-03-18 13:08:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-17
MD5: 7963e869f5829452d5b1600bf949f1b4 SHA-1: 3e40fb063d0b3b6599a4df4c0de1f373c163b7af SHA-256: 5c6f37b46366d02fbe3d3c257d95b9830375af639e8462a87a05fd351d37471d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to 'basic cooking principles' to mask the malicious redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/aws?utm_term=what+are+the+basic+cooking+principles PDF link annotation
    • http://sadovik.me/california_common_core_standards_language_arts_third_gradeqdzwz.pdfIn PDF document text
    • http://microdigitalmeter.xyz/30168279970bsgx2.pdfIn PDF document text
    • https://cdn.sqhk.co/pemiduwegam/Hwjejhn/affirmation_examples_for_students.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4477369/normal_601fa5300a4aa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4480880/normal_602ca01be38ea.pdfIn PDF document text
    • https://cdn.sqhk.co/letaziseb/Pgi9yke/atif_aslam_old_songs_mashup_unplugged_mp3_download.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4394060/normal_601eaa3bcce76.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4401517/normal_60411cc0e00c4.pdfIn PDF document text
    • http://cetapp.xyz/terarutaxilifonigunrkpdk.pdfIn PDF document text
    • https://cdn.sqhk.co/rekutadis/ggqkCjc/96755966336.pdfIn PDF document text
    • http://vurolak.iblogger.org/best_tutorials_for_photoshop_beginners.pdfIn PDF document text
    • http://vadusulu.iblogger.org/donald_duck_meme_template.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486041/normal_602fdd53266d7.pdfIn PDF document text
    • https://cdn.sqhk.co/bujasugawo/hfeihhd/miro_clash_of_clans_download_apk.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/turip/17632409166.pdfIn PDF document text
    • https://s3.amazonaws.com/lovomijelun/tepojiromofunowegupobusug.pdfIn PDF document text
    • http://gapumigexoze.epizy.com/what_is_relational_dialectic_theory.pdfIn PDF document text
    • https://s3.amazonaws.com/rimepusox/chitrali_audio_songs.pdfIn PDF document text
    • http://sipopos.epizy.com/puxuletozobifuzewob.pdfIn PDF document text
    • https://s3.amazonaws.com/xupovobejanam/jeretivolalep.pdfIn PDF document text
    • https://s3.amazonaws.com/niporofez/african_love_poems_and_proverbs.pdfIn PDF document text
    • https://s3.amazonaws.com/miledu/two_examples_of_a_gatekeeper.pdfIn PDF document text
    • https://s3.amazonaws.com/pasutiz/expense_report_form_excel.pdfIn PDF document text
    • http://nozoxujurasota.epizy.com/how_do_i_add_soap_to_my_simpson_pressure_washer.pdfIn PDF document text
    • https://s3.amazonaws.com/bidurudilidujug/24819476306.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e771.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE771 5412 bytes
SHA-256: 97bb910d5d75d245427840da8d33fbbce91ebb93f683a6b723b4c5467a9ddbc0
font_01_sfnt_off0000f9e0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF9E0 10536 bytes
SHA-256: 26a2b86356080672c73be67bb446dd808b9938f232d488cf3371babb7609444f

Open this report in the interactive analyzer, or submit your own file for analysis.