Malicious PDF — malware analysis report

Static analysis result for SHA-256 60ac6ce19cf612dc…

MALICIOUS

PDF

99.7 KB Created: 2021-05-28 20:30:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 1db1cc6bd3ca0431a16662fb226b0721 SHA-1: 5a510c1cd7c449b9b46d29fa10b3a888ce3ae359 SHA-256: 60ac6ce19cf612dc7fef1652d5945691faa39761a99f388f8926085bf0f1fde5
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a ML classifier and ClamAV. It contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. No scripts were extracted, but the presence of the external URI suggests an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=cardcaptor+sakura+clear+card+volumes PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4489976/normal_604e339080392.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388285/normal_6033f00f8ae32.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4455898/normal_6000c870814a1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4368492/normal_5fc6bb183bcb1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388283/normal_600cfa2f194c3.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4482638/normal_5ff87f2522209.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378393/normal_5fd8f6c01af75.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4368221/normal_5fe02c9d01be0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4425924/normal_6035439126a69.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4466680/normal_602b238d57496.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366364/normal_602a974884534.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416927/normal_5fe8551e7bd0e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4460072/normal_602d803b78ed8.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/7c6a3567-fb9e-4cad-bb89-4fdb69c9e25f/mirofaxofapizejoje.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bd231ef8-fd94-4475-b843-36f066f1d422/14582179839.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/04e13ac0-1de3-4ec0-a748-5550532a371e/duwivasaj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/98410357-27ec-4fe4-8d40-78cbaeaf6828/11466875330.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d13c650a-f525-4072-a940-8fc2867b6260/pelicula_el_guardian_del_centeno.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ad1ad33b-4923-458a-b913-b1779a1a719a/what_is_the_purpose_of_psychology_of_religion.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8432b309-546d-4eb2-891e-c90c290bf1b2/breadman_bread_machine_manual_tr444.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ab210e61-bb79-4083-bfc1-d5aab9d34776/bradley_smoker_bisquettes_cabelas.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ef5e708c-1325-40e8-9f53-0ebbb4cec4a0/how_do_you_explain_poetry_to_a_child.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7f7a38a6-ee2b-4404-8942-bc292d9b0ac5/36470149309.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001180e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1180E 14564 bytes
SHA-256: b6b3719d3fef392a30f0d47f4225c5949f424b8609220c6516c2e84d250d12a7
font_01_sfnt_off000147c7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x147C7 5248 bytes
SHA-256: 751b098843919e4815468aee6a7f8157f408a488dfdd909398d269dab2d31450
font_02_sfnt_off0001598f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1598F 11968 bytes
SHA-256: d9262e84e74b559db2044d5241709625a197f41fc1fd7676e6ecfdb238ae47f8

Open this report in the interactive analyzer, or submit your own file for analysis.