Malicious PDF — malware analysis report

Static analysis result for SHA-256 5e8a73161f48619a…

MALICIOUS

PDF

107.9 KB Created: 2021-06-06 19:10:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 371300905db96b0b6b906b4ee76b77f2 SHA-1: c88fca0344f71a8059f3d661f9b18f4e9a0e3929 SHA-256: 5e8a73161f48619a8a6f791c1f7f06ebd73e79595c39355120e0168ad0237f19
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ML classifiers and ClamAV. It contains an embedded URI pointing to a suspicious domain, which is likely the primary lure. The document body, though heavily obfuscated, appears to contain text related to divisors, suggesting a deceptive pretext for the user to click the malicious link. No scripts were extracted, but the presence of an external URI and the overall malicious verdict strongly indicate a phishing or scam attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://drafthe.ru/pbw?utm_term=divisores+de+126+y+90 PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4427086/normal_604d7cab1eb9e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449627/normal_605fbd7ec11a0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450732/normal_604715a199f74.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4425723/normal_6063e5ca9ffff.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/93523f12-f88b-4956-8562-a9e0eadb4073/how_can_karst_topography_form.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/612b1c54-8e4a-433b-b6e6-ada9bb08ff82/after_anna_todd_book_plot.pdfIn PDF document text
    • http://mepijewaj.pbworks.com/f/gusag.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/91e9f217-5e0a-4fdf-9c63-5a883b80beff/toro_lx425_twin_cam_for_sale.pdfIn PDF document text
    • http://vedufid.pbworks.com/w/file/fetch/144528666/river_city_ransom_store_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5478bbd4-d5c1-483b-b998-447974b87bde/1999_polaris_scrambler_500_4x4_owners_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/76861366-c1c6-47ea-8e24-4f3d08b7b3c7/15789426347.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9d14b14b-b438-4acf-b05b-78d3f89f4b2d/how_to_download_cooking_fever_on_pc.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b9d5671b-d7a2-4e18-a29d-255e75be86e5/minn_kota_riptide_st_80_owners_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/73e90313-dc5e-4063-a954-3a8d3b035944/70800844005.pdfIn PDF document text
    • http://sufizilofab.pbworks.com/w/file/fetch/144607335/vitasimatirafelebuxiwi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/658c2019-6a04-4b51-a329-bdcf77ccf37b/similes_exercises_for_grade_3.pdfIn PDF document text
    • http://pebenuziwi.pbworks.com/f/farewell_speech_by_students_of_class_10_in_marathi.pdfIn PDF document text
    • http://luwivaj.pbworks.com/w/file/fetch/144724128/kotor_2_companion_guide_gamefaqs.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/49eaede1-2d8f-445a-8641-00dfc3b2796d/nalusukizuled.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/db76433f-881b-4508-ba14-fcd8463d6e70/nenodogidelilotekatarewas.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00016a42.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16A42 5376 bytes
SHA-256: c1478ee2a80b8869f429fec5109ed8ad71472c83301b4b19706a1a1c2a1fc411
font_01_sfnt_off00017cad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17CAD 10980 bytes
SHA-256: 9a2ad482aca6de93076ec0f2f3dc00c2d70ed86dfe92ca6cdddc0f564e2bf271

Open this report in the interactive analyzer, or submit your own file for analysis.