Malicious PDF — malware analysis report

Static analysis result for SHA-256 5da764200d0653da…

MALICIOUS

PDF

104.9 KB Created: 2021-04-01 00:18:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: cf8a5d1ee7c8ca31556908c0d2e0f93b SHA-1: 94ba2b6484d1cc0837f8bdc8e34d07714180f9e7 SHA-256: 5da764200d0653daf97d8e7c4126d62bf27d73352408ecceacc8ed9fde183df4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though partially corrupted, suggests a lure related to 'Buku yasin dan tahlil lengkap pdf' to entice clicks on the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/123?utm_term=buku+yasin+dan+tahlil+lengkap+pdf PDF link annotation
    • http://leseweremizew.scienceontheweb.net/an_update_of_wallace_s_zoogeographic_regions_of_the_world.pdfIn PDF document text
    • http://japancar-sib.ru/hola_amigos_textbook_answerscvs4a.pdfIn PDF document text
    • http://lukiduxipapep.mywebcommunity.org/phn_mm_chuyn_file_dng_nh_sang_word.pdfIn PDF document text
    • http://sifaritube.sportsontheweb.net/8274332434.pdfIn PDF document text
    • http://musc-media.xyz/minima_moralia_reflections_from_damaged_life4hy45.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/fe2e9f5d-40b4-4b4f-b77c-708bbb40b303/30619524745.pdfIn PDF document text
    • https://s3.amazonaws.com/xoguwavosuje/new_bhojpuri_video_3gp_mp4_hd.pdfIn PDF document text
    • https://da25564d-e3c2-4b9b-87ba-dd8ce2ae78d4.filesusr.com/ugd/c82cd6_6a29cb9b0cd448ed94a0529f3b3957ba.pdf?index=trueIn PDF document text
    • https://a98f38e8-5810-4fc9-be6a-c3d78c7c4f9f.filesusr.com/ugd/921909_9b1e1c90e95b49ffbeb0d1024579d998.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/nonipesikiri/fekufipufamomifu.pdfIn PDF document text
    • https://68e1e3d4-268d-49bc-a8aa-b119cb10fea7.filesusr.com/ugd/3ceeb9_40d999d1ff964260b20d1ea3d6779204.pdf?index=trueIn PDF document text
    • http://somasetowijo.myartsonline.com/jekanubo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/09d6046e-4b83-4c30-9ab6-ef2237a265ae/walter_benjamin_aura_photography.pdfIn PDF document text
    • https://s3.amazonaws.com/kukupunopedon/49843878697.pdfIn PDF document text
    • https://e510c2d5-567e-4a96-89ff-abc18316baf7.filesusr.com/ugd/8a9bcc_30599107d09641208f72e2476773f895.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/bipepezuwed/74362715394.pdfIn PDF document text
    • https://0503187d-52cd-4237-9521-a3cb9bf551ae.filesusr.com/ugd/5bb01c_669b26c1f85b4c4eba4624199e5b8377.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/kisimujuk/nuwelafududomexipiwuz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f5f6951a-6ad8-4cd5-bcab-be835f95dc60/kipolanawumojanigox.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7564e970-d761-4e0a-97a9-7169ef13fe69/20989746269.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00014e8f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14E8F 5196 bytes
SHA-256: dc9076674f1cc4a50872801b2fe7f4d7651bb139e90910984ad11d6915cee97d
font_01_sfnt_off00016042.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16042 12452 bytes
SHA-256: 30b9ed43cc2b58999391eed109490397c6f3d6ca3bfb7109a604663b44847c75
font_02_sfnt_off0001883a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1883A 4324 bytes
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378

Open this report in the interactive analyzer, or submit your own file for analysis.