PDF static analysis report

Static analysis result for SHA-256 6013e338a4f61403…

SUSPICIOUS

PDF

169.4 KB Created: 2020-03-25 05:53:48 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-24
MD5: 5a234e2c16a56fba0952a8ce77112e18 SHA-1: e7120b2da8f7c9d527be29537ab45821b7bcb631 SHA-256: 6013e338a4f61403f5cc3ee9ddcceb5e7595ce33ccac7d8cf8ae8cb6da42da1f
36 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that, when visited, likely leads to a malicious payload. The document body, though heavily obfuscated, contains text related to 'Vector calculus colley solutions' and the authoring application 'wkhtmltopdf', suggesting a lure to disguise the malicious intent. The ML classifier strongly flagged this PDF as malicious, indicating a high probability of malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9957

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://skinspiritlife.com/uploads/1/3/0/7/130738603/130738603.html#vector+calculus+colley+solutions PDF link annotation
    • http://mtdorabuzz.com/uploads/1/3/0/6/130622080/timonamuja.pdfIn PDF document text
    • http://campbell-france.com/uploads/1/3/0/5/130540767/8365355.pdfIn PDF document text
    • http://retruckaust.com/uploads/1/3/0/6/130604799/somusedagomej-depekanaxawep.pdfIn PDF document text
    • http://commercial.kathynairnphotography.com/uploads/1/3/0/6/130604203/zomupegi.pdfIn PDF document text
    • http://prestigesandv.com/uploads/1/3/0/2/130271017/1906024.pdfIn PDF document text
    • http://74-123-76-205.mgwnet.com/uploads/1/3/0/5/130545484/winubinugogemix.pdfIn PDF document text
    • http://meredithmorrisisawesome.com/uploads/1/3/0/7/130775567/rimiv.pdfIn PDF document text
    • http://calldavid.com/uploads/1/3/0/6/130639115/2058495.pdfIn PDF document text
    • http://troop827.info/uploads/1/3/0/6/130621706/7213131.pdfIn PDF document text
    • http://innerfoundations.org/uploads/1/3/0/2/130288326/jagolani_tuwapigog_kuvek_jidipikasageg.pdfIn PDF document text
    • http://midwestpark75.com/uploads/1/3/0/5/130551356/3a34ab.pdfIn PDF document text
    • http://wimberstrong.com/uploads/1/3/0/5/130588627/f4531aea.pdfIn PDF document text
    • http://beyourselfie.net/uploads/1/3/0/7/130775741/mixunolava_narugigipalo_tipalifitosun_xilokefiso.pdfIn PDF document text
    • http://hasbropowerrangers.com/uploads/1/3/0/8/130873923/julixazeze_bakebiwesu_zuxolugub.pdfIn PDF document text
    • http://cortinarealtygroup.com/uploads/1/3/0/5/130588839/xalojasa-rabave-tipujivudede-witomapobipekob.pdfIn PDF document text
    • http://biokeen.net/uploads/1/3/0/3/130379193/1528462.pdfIn PDF document text
    • http://www.server.employeetimeclocks.net/uploads/1/3/0/9/130969053/4879318.pdfIn PDF document text
    • http://greenmytown.org/uploads/1/3/0/3/130323212/vepawijepora-munumevelokal.pdfIn PDF document text
    • http://ohanezendiigbomi.org/uploads/1/3/0/4/130476207/fotesojewukadedove.pdfIn PDF document text
    • http://reelpatriotapparelllc.com/uploads/1/3/0/8/130874045/muzikimize_doluraxogimoz_bipibetobo_wizudopire.pdfIn PDF document text
    • http://neeshazollinger.com/uploads/1/3/0/3/130379078/zogidu_nuxotat.pdfIn PDF document text
    • http://vita-mens.com/uploads/1/3/0/5/130588951/makorarivomujagupu.pdfIn PDF document text
    • http://petslicense.com/uploads/1/3/0/7/130738526/1ffeeb.pdfIn PDF document text
    • http://mta-sts.mail.abbeynairn.com/uploads/1/3/0/8/130813756/3b4fc3803596d61.pdfIn PDF document text
    • http://carltgoss.com/uploads/1/3/0/5/130542710/kedejadoti_luxibeturibeva_ranibaxiki_kiwusebizemeni.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
🗂 Part of campaign: beyourselfie.net 3 samples

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000232e4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x232E4 10104 bytes
SHA-256: da1032489cd30e21fba5f42982bf562091bcd9ea1958202fd5afc32f0677dc52
font_01_sfnt_off00025870.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x25870 5092 bytes
SHA-256: 9e89fb3680e3f5ef673a1081d326c76d7ff4e1b00cb29f3d23374fcfb20f5c86
font_02_sfnt_off000268bd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x268BD 4856 bytes
SHA-256: aa65376ba900252c4e36c3bc090f6e2c3f3199772d0aed3385c6d9956abfa204
font_03_sfnt_off000278dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x278DC 17608 bytes
SHA-256: 0a1466d86dd13712fb8a18cd00a4476e0230f98ee57f53a95538b89e99699f45

Open this report in the interactive analyzer, or submit your own file for analysis.