Malicious PDF — malware analysis report

Static analysis result for SHA-256 6210912f458319fa…

MALICIOUS

PDF

66.8 KB Created: 2021-04-03 05:59:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2d5d5cd6275ded28a8eb6a0a2c568e71 SHA-1: d0abf6b78714c00cdd89d2b06520dbcfa1471617 SHA-256: 6210912f458319fa61f194b047f416e7159ca1140fcc9d3a502f86c3c22f975a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI that redirects to a URL associated with phishing content, masquerading as a search result. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URI suggest it's designed to deliver a malicious payload or redirect the user to a phishing site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=what+does+lll+mean+on+my+taylor+thermometer
    • http://istra-backwater.ru/64633677532972gf.pdf
    • https://cdn.sqhk.co/tezabulaw/jcFharR/ice_cream_van_simulator_beta_script.pdf
    • http://jidokove.scienceontheweb.net/jeloguv.pdf
    • http://zefujixa.mywebcommunity.org/ibps_bank_exam_syllabus_download.pdf
    • https://cdn-cms.f-static.net/uploads/4446915/normal_6061243488fb1.pdf
    • https://cdn-cms.f-static.net/uploads/4476757/normal_605b948c2e467.pdf
    • https://cdn-cms.f-static.net/uploads/4461497/normal_6061638e4f533.pdf
    • https://cdn.sqhk.co/siwowoso/cghVLch/62539773715.pdf
    • http://mokemowowove.mygamesonline.org/oscillator_mcq_download.pdf
    • http://sokobumoxagug.scienceontheweb.net/fijekefilor.pdf
    • http://souve.me/kaxedaboguvubuzipubir4gdh7.pdf
    • https://cdn.sqhk.co/sunawopi/ChhT7BE/mens_haircuts_short_sides_medium_top.pdf
    • http://harkateine.fun/classical_ringtones_for_android_freeyecum.pdf
    • https://cdn.sqhk.co/wikaraxixi/jajeggK/rob_zombie_living_dead_girl_movie.pdf
    • http://ru-payment.casa/smartypants_ap_environmental_sciencev24zn.pdf
    • https://static.s123-cdn-static.com/uploads/4392452/normal_5fffdccc03f6c.pdf
    • https://cdn.sqhk.co/bivuwusim/sqHifid/urban_drug_empire_ranks.pdf
    • https://cdn-cms.f-static.net/uploads/4489241/normal_5fd1ea3abb055.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/816892a7-f1f7-4879-bc77-fb9b92b8d543/what_is_the_remote_code_for_samsung_soundbar.pdf
    • http://varirojemixu.myartsonline.com/todos_los_circulos_armonicos_de_la_guitarra.pdf
    • https://uploads.strikinglycdn.com/files/50d4eebb-1a68-4f31-912a-31b47fe59dae/tractor_john_deere_ground_loader_12v_peg_perego_-.pdf
    • https://uploads.strikinglycdn.com/files/e0f7ecf3-7bdd-43c8-89b7-be1b440cd050/asus_router_rt-n12d1_login.pdf
    • http://xinifaduzinuvu.onlinewebshop.net/86342811411.pdf
    • https://uploads.strikinglycdn.com/files/7211b893-6a4f-42d3-b4b0-54f431c78dbd/viktor_frankl_theory_of_personality_ppt.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cb43.bin
49f4a38d2995ed42b59ae52832fc39efe20bed2b4b7d78069a495ff5c0d555ef		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCB43 5180 bytes
font_01_sfnt_off0000dcc6.bin
5953f23ef47944e69f0734883b25e7f89f4c8226c746424b83d79e99447cb43e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDCC6 9444 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.