Malicious PDF — malware analysis report

Static analysis result for SHA-256 5d26f18a55a089cf…

MALICIOUS

PDF

79.8 KB Created: 2021-04-13 14:22:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-02
MD5: 9601ae7571e72d7e9889116c7e08f2c3 SHA-1: ece5b0ec2b2c06fbfc067a04ab7fc9b456fbad3f SHA-256: 5d26f18a55a089cfed01bd3391310b3e994e5a0bbd00c1d63b209c839de446a1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a critical heuristic firing for PDF phishing malware. An external URI pointing to 'maypoin.ru' was extracted, suggesting a phishing or malware distribution attempt. While no scripts were explicitly extracted, the PDF structure and embedded URLs indicate a likely attempt to redirect the user to a malicious site, potentially for credential harvesting or further payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/strik?utm_term=the+monkees+albums PDF link annotation
    • https://cdn.sqhk.co/zuronenom/heub8ja/online_bike_shop_usa_international_shipping.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447466/normal_6039e75e82171.pdfIn PDF document text
    • https://cdn.sqhk.co/terasovo/jfjb0Os/average_tip_percentage_for_pizza_delivery.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4487191/normal_60438791d1599.pdfIn PDF document text
    • https://cdn.sqhk.co/wokuvaxevaji/kKLIqY4/76546626867.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/rafiralexezol/54851099363.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9d16baeb-8190-42f4-a9f5-b24792d4113b/love_language_survey_quiz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/59d22514-6f19-46f6-b7a8-fd273eb6d6a0/how_much_do_starbucks_baristas_make_in_tips.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2b8cc6f8-22af-4e5b-8c83-cc96ad883bd0/the_intelligent_asset_allocator_free.pdfIn PDF document text
    • https://s3.amazonaws.com/mipizaju/coldest_place_in_the_world_right_now_2019.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fd019207-9601-4801-aeef-372de5d3a7e3/13422353351.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b55d74c9-9eb2-4b47-bdbe-413371625af3/horse_dog_hybrid.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1143c115-a59d-44e7-9772-994093ea5640/22433565847.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ff249f26-6e8b-4207-aad8-34168d92026d/ge_adora_refrigerator_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/02a41bc6-1e55-4bef-8457-278a896b0c83/what_is_chlorophyll_found_in.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/340fed32-9de2-42c6-b060-04d2ab6cdb5b/all_sat_practice_tests.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/86a08df5-b384-48f2-abf4-2459d53ef57a/27088416331.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/759661a5-3da7-4583-85ce-4237c801ebc3/55588093801.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed2e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED2E 4736 bytes
SHA-256: 9c417e8e468e42bc4d0c468849e8ce810581ad167920095db20a8f3e03b5a629
font_01_sfnt_off0000fd1a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD1A 11548 bytes
SHA-256: 5313b730dcf80d205527b57ad2a9ca5770aa00f38959e0199339c9e0d8b7c1ff
font_02_sfnt_off0001240e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1240E 4324 bytes
SHA-256: a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f

Open this report in the interactive analyzer, or submit your own file for analysis.