Malicious PDF — malware analysis report

Static analysis result for SHA-256 617d8e7c5f1e5272…

MALICIOUS

PDF

76.2 KB Created: 2021-02-25 08:00:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 88ae7b086a65e8fcd99e9d16bca5d73c SHA-1: 039a03c80ef73725e55261d06e2b097735f7051b SHA-256: 617d8e7c5f1e527266a758c0b1ca2065d13cd3ee8ff0278c1815f4df4fe994ec
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ML classifiers and ClamAV, specifically identified as Pdf.Phishing.Trojan. The embedded URL points to a domain that appears to be part of a phishing or malware distribution scheme, masquerading as a search result. The document body, though heavily obfuscated, contains references to wkhtmltopdf and Adobe, suggesting a potential lure related to software or shortcuts.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=adobe+animate+edit+shortcuts
    • https://static.s123-cdn-static.com/uploads/4380079/normal_60052da46fdbc.pdf
    • https://cdn.sqhk.co/fapiwejagiz/ibhagdv/kujogutetukoruz.pdf
    • https://cdn-cms.f-static.net/uploads/4367311/normal_601c006ca5307.pdf
    • https://static.s123-cdn-static.com/uploads/4527747/normal_5fe5016b19cf6.pdf
    • https://cdn-cms.f-static.net/uploads/4387040/normal_6010382e6b8f8.pdf
    • https://static.s123-cdn-static.com/uploads/4483602/normal_5fc7dcff949fa.pdf
    • http://simcars.ru/what_are_the_factors_affecting_school_community_relationsk8mlq.pdf
    • https://cdn-cms.f-static.net/uploads/4389097/normal_601150f3ce263.pdf
    • https://cdn-cms.f-static.net/uploads/4413373/normal_6025a4e3ad6e8.pdf
    • http://wei-nmvc.com/kebixog2efy.pdf
    • https://cdn-cms.f-static.net/uploads/4377380/normal_5fe8372694747.pdf
    • http://vuvulusigi.scienceontheweb.net/rumoki.pdf
    • https://cdn.sqhk.co/jefulajidi/hjYhbJj/41071313917.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/fikuvine/java_lang_classnotfoundexception_jasper_reports.pdf
    • https://s3.amazonaws.com/sezewu/twitter_header_template_2018_psd.pdf
    • https://s3.amazonaws.com/jajuzasalikirut/algebra_de_baldor_pagina_171_ejercicio_106_resuelto.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e20d.bin
cc4f26f3917578586f47fe6c2758e4c85d35d7b55aa755b2f8c8b75aab3d9b91		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE20D 5276 bytes
font_01_sfnt_off0000f3d5.bin
4a0ef55ed1ec225a99086ab3a50709636b1ef20f84f7881c306bdd518f4d32dc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF3D5 15184 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.