Malicious PDF — malware analysis report

Static analysis result for SHA-256 5f7b61495e750687…

MALICIOUS

PDF

313.0 KB Created: 2021-04-16 05:00:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-29
MD5: f22269c3f65caa305ef6160c4d8f832e SHA-1: 7060a34163996e516964b9c03f988b3e57071db3 SHA-256: 5f7b61495e75068732293819ce394cf8de5d9ad15cdce76e2c4a0cd3207fea85
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains embedded URLs that lead to potentially malicious sites, disguised as legitimate file uploads or search results. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were directly extracted, the presence of embedded URLs and the nature of the heuristics suggest a phishing or credential harvesting attempt, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9963

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://portal-mysigma.com/system/files/student-proof/47432021317.pdf In PDF document text
    • http://seiary.com/sites/default/files/webform/rec/11252708720.pdfIn PDF document text
    • https://www.clinicasfantamaria.ro/sites/default/files/webform/33767122539.pdfIn PDF document text
    • https://www.a1touchsolution.nl/sites/default/files/rowiduw.pdfIn PDF document text
    • http://www.guninetwork.org/system/files/webform/heirri_proposals/80098342864.pdfIn PDF document text
    • https://ambrose.edu/sites/default/files/webform/71048230710.pdfIn PDF document text
    • https://www.jsif.org/sites/default/files/webform/kedoruxanagavapiwo.pdfIn PDF document text
    • http://pilgrimland.com/sites/default/files/webform/resume-uploads/mikax.pdfIn PDF document text
    • https://www.visitsavannah.com/sites/default/files/webform/fukixuliwidopisoduzurapi.pdfIn PDF document text
    • https://www.a1touchsolution.nl/sites/default/files/togivem.pdfIn PDF document text
    • https://ambrose.edu/sites/default/files/webform/42416127327.pdfIn PDF document text
    • https://www.mainephilanthropy.org/sites/default/files/nikosomonebazi.pdfIn PDF document text
    • https://www.afscme65.org/system/files/webform/baxuwobokorexifiri.pdfIn PDF document text
    • http://oaklandchildcare.org/sites/default/files/webform/70037852461.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://feedproxy.google.com/~r/Uplcv/~3/ngfLrbzwjls/uplcv?utm_term=what+is+the+relative+location+of+china+to+australiaPDF link annotation
    • https://lib.asu.edu/system/files/webform/simadovi.pdfIn PDF document text
    • https://community.princeton.edu/system/files/webform/26098210740.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0004a12a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4A12A 5044 bytes
SHA-256: ee1acc2775ee49d3faac3546192d6af5dd1ff312b04846ea1e1d51a6a5645ab9
font_01_sfnt_off0004b25f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4B25F 10216 bytes
SHA-256: bd9d15d66aaa5a8946edc11ca7efc596f3bc393c1aad120d8d3ae7d399d0fa37

Open this report in the interactive analyzer, or submit your own file for analysis.