Malicious PDF — malware analysis report

Static analysis result for SHA-256 61d1ee45d46a2356…

MALICIOUS

PDF

70.5 KB Created: 2021-03-17 10:56:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f9a3b3356488096c1c6d9791f4976833 SHA-1: 5f3622a45a7f6ebca2285e858bc9cbc6657976b6 SHA-256: 61d1ee45d46a23561c6906cb5dbf995b27d99e17063c0c074085256b48d24e67
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, identified by both ML classifiers and ClamAV as malicious. The document body is heavily obfuscated, but the presence of the external URI strongly suggests a phishing or malware distribution attempt. No scripts were extracted, but the PDF structure itself facilitated the embedding of the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=dj+maxwell+mixtape
    • https://cdn-cms.f-static.net/uploads/4501208/normal_600a11cac714b.pdf
    • https://cdn.sqhk.co/dolitife/jijJhi4/55975268804.pdf
    • https://cdn-cms.f-static.net/uploads/4409248/normal_603edb1bd810b.pdf
    • http://maddot.space/17778990745y4wps.pdf
    • https://cdn.sqhk.co/dujovibipu/LBiijjf/horse_games_pc_offline_survival.pdf
    • https://static.s123-cdn-static.com/uploads/4484383/normal_5ff854ae6863e.pdf
    • http://ygrash.website/6076881624ue1br.pdf
    • http://phulop.store/bebe_rexha_songs_mp4g1pem.pdf
    • https://static.s123-cdn-static.com/uploads/4465557/normal_6003edaf62e3d.pdf
    • https://cdn.sqhk.co/jabisopomuxo/ehjEwge/physics_cat_memes.pdf
    • https://cdn.sqhk.co/bezedono/kAr7igd/www._youtube._com_activate_ps3.pdf
    • https://cdn.sqhk.co/gabixeme/g9KLmhd/lukofa.pdf
    • https://static.s123-cdn-static.com/uploads/4401505/normal_6005caa48f667.pdf
    • https://fupodakabapamom.weebly.com/uploads/1/3/4/4/134489617/suvunu.pdf
    • http://summer-italy.fun/summary_of_seedfolks_characters50ikm.pdf
    • https://cdn.sqhk.co/nurofiwele/bicgfie/starz_movies_2020.pdf
    • https://kelogukagikuval.weebly.com/uploads/1/3/0/7/130739039/5291573.pdf
    • https://tufuziboserivu.weebly.com/uploads/1/3/1/6/131636644/0cda43.pdf
    • https://cdn.sqhk.co/lukisebeka/abhjdhi/sosav.pdf
    • http://scrlt.xyz/kipsta_b700_manualu457x.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/dbec7058-c615-415c-9c7a-74021a08870f/the_meaning_of_marriage_chapter_4_summary.pdf
    • https://uploads.strikinglycdn.com/files/101f684b-f662-4b90-84bd-073a083fa9ac/pentair_superflo_parts.pdf
    • https://uploads.strikinglycdn.com/files/caf7f9e5-a3ff-421a-80a2-be7b377fcafe/29256332351.pdf
    • https://uploads.strikinglycdn.com/files/dcdfa15e-3ad5-488c-9f09-f3b20e4f928e/which_of_the_following_is_an_example_of_heat_transfer_by_radiation_candle_flame_sun_fire_stove.pdf
    • https://uploads.strikinglycdn.com/files/29f1686b-d173-4d0f-b813-1df43baa8239/30594411141.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d442.bin
9a4602d85b66dec7faffcefa7048eed65fe9c2a74d0c01022b34b78fc4da9705		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD442 4924 bytes
font_01_sfnt_off0000e510.bin
f440703b7047c025c700217f3a4ca4f7139736babc5a3c06e60a5d280c8db3ac		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE510 11132 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.