Malicious PDF — malware analysis report

Static analysis result for SHA-256 5f9a29ff4f40624c…

MALICIOUS

PDF

78.7 KB Created: 2021-03-17 15:48:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-30
MD5: 94d19b83a03886a6676b27ce04e4d403 SHA-1: 93e9e7e8d8354018ca94f2b181993200b41f3689 SHA-256: 5f9a29ff4f40624c4fbc3cbbb50719aa69d9bfc9c89b55a5a5339e82fae733da
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that mimics a search query, likely intended to trick the user into visiting a malicious site. While no scripts were directly extracted, the PDF structure and embedded URI suggest a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=bedford+school+district+rating PDF link annotation
    • http://vaxuzorokolate.iblogger.org/98570658813.pdfIn PDF document text
    • https://tadonajates.weebly.com/uploads/1/3/4/3/134319020/gunegakurubiv-samuw.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4420239/normal_5fcdf13498b8d.pdfIn PDF document text
    • https://puwikopigab.weebly.com/uploads/1/3/1/1/131163601/2cd5dca.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4480402/normal_60247111c63e4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4421464/normal_6000c1488384f.pdfIn PDF document text
    • https://debuvubuni.weebly.com/uploads/1/3/4/8/134846467/2514912.pdfIn PDF document text
    • https://cdn.sqhk.co/kulobibab/djgidjc/simon_s_cat_pop_time_endless_challenge.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454809/normal_5ff25dc431b47.pdfIn PDF document text
    • https://cdn.sqhk.co/kagixepo/jcjdJij/fortnite_drift_mask_papercraft.pdfIn PDF document text
    • http://zawezumibinigot.iblogger.org/hifi_corp_south_africa_catalogue.pdfIn PDF document text
    • https://rasisepuwefu.weebly.com/uploads/1/3/4/6/134678142/firakojolu_sepad_pikugolixipi_sabil.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4490364/normal_5fcb05ffd2edc.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jolunenafobuw/bajojapemas.pdfIn PDF document text
    • https://s3.amazonaws.com/kudowo/wulud.pdfIn PDF document text
    • https://s3.amazonaws.com/jarirotexab/accounting_made_simple_summary.pdfIn PDF document text
    • http://gajamozaxekega.atwebpages.com/cognitive_psychology_approach_means.pdfIn PDF document text
    • https://s3.amazonaws.com/fogibi/or_arbeitsvertrag_kndigung_form.pdfIn PDF document text
    • http://limoxukuk.atwebpages.com/universal_laser_systems_pls6.150d_price.pdfIn PDF document text
    • http://nakeviw.myartsonline.com/bovumofasixuxutikuta.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd25.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDD25 5332 bytes
SHA-256: 0d9679ffdd2b08d7b5914239518f34316d183705b39b9c57dd97b4fe5d8d0f79
font_01_sfnt_off0000ef49.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF49 11316 bytes
SHA-256: b2e3f1ae1ccde399f668329dd67289ea995afd9a1f86137772ff9b4615f632f0
font_02_sfnt_off000115dd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x115DD 16204 bytes
SHA-256: 541fa2b6826b0add99b7d5a173ef1e6a5567607b5192f75b810eb17d6a563501

Open this report in the interactive analyzer, or submit your own file for analysis.