Malicious PDF — malware analysis report

Static analysis result for SHA-256 5f6ab32eaf92ae9f…

MALICIOUS

PDF

76.4 KB Created: 2021-03-06 07:03:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 53cde651597b50e26422bd21208e388d SHA-1: 1869167177d1837f363fa5358b73bf77a2ad2356 SHA-256: 5f6ab32eaf92ae9f4a32d47d30297c0061644a4a3b9bdb92c902da2a57d61d8a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded PDF URI points to a suspicious domain, suggesting it's used to redirect users to a phishing or malware distribution site. While no scripts were explicitly extracted, the PDF structure and embedded URI are strong indicators of a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=sigma+sport+bc+1200+wireless
    • http://copyright-services-us.com/44835876648wavm7.pdf
    • http://krokoboko6.xyz/dadamevezirasalovoduwi252pn.pdf
    • https://cdn.sqhk.co/mugukawi/wQehghb/brick_cross_breaker_game.pdf
    • https://cdn.sqhk.co/rujiwujik/jjTgd9K/tegiwobugumotewajaw.pdf
    • http://bitcoinlearningcentre.online/xinexuzio6zuu.pdf
    • http://redita.fun/bubble_bobble_classicc3280.pdf
    • http://circulshtangcalip.website/dlp_symantec_data_sheetdze7x.pdf
    • http://grizhoff.ru/aiff_full_form_in_computer0ld2a.pdf
    • https://cdn.sqhk.co/losomilodip/Zhehbge/supreme_stickman_warriors_2_mod_apk.pdf
    • https://cdn.sqhk.co/wojipezusax/Sica8gi/democracy_in_america_summary.pdf
    • http://parrrtner.xyz/christian_d_larson_i_promise_myselfpsa74.pdf
    • http://just-gopro.com/multiplication_problem_solving_worksheets_grade_4iu5ih.pdf
    • http://dokumenty-kiev.online/2013_jeep_grand_cherokee_radio_resetjq4c4.pdf
    • https://cdn.sqhk.co/niporatibu/aihTige/kikedumanab.pdf
    • http://persequenteamsohbet.com/nokuloiw47s.pdf
    • http://stnold.com/4563254089kh8j6.pdf
    • http://unlockdeals.shop/goxitefirudibemevrptb.pdf
    • http://vashmaster.info/lagu_clara_mae_i_forgot6t9ko.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/55cbce87-e722-4999-b292-c45a084a3cf1/handy_stitch_instructions.pdf
    • https://s3.amazonaws.com/vavale/44673240158.pdf
    • https://uploads.strikinglycdn.com/files/75f41c2a-a8f7-45bb-a5bc-6eb67874ce37/botojorowowobusekenowano.pdf
    • https://s3.amazonaws.com/figidireki/father_and_son_summary_cat_stevens.pdf
    • https://uploads.strikinglycdn.com/files/60419fd3-a555-42ea-9c58-050c55b18cdc/remington_electric_chainsaw_pole_saw.pdf
    • https://uploads.strikinglycdn.com/files/feec7b86-f39f-4bff-a8e5-db139773adfe/clases_de_sistema_operativo_para_mvil.pdf
    • https://uploads.strikinglycdn.com/files/7cfa0f3c-11e0-4923-9752-af9487f47d7c/lofikemopinulinibedijud.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e96a.bin
d3a24e06439c3c37eb491289314e82383e66bc5fcb4a2127f03a51b8f777d76b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE96A 5912 bytes
font_01_sfnt_off0000fd85.bin
42442cbef7dc086972bb9021f5dc3b5d9722642ceb02ce021735d8888902adc8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD85 11656 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.