Malicious PDF — malware analysis report

Static analysis result for SHA-256 622de6c2fa7d0107…

MALICIOUS

PDF

71.6 KB Created: 2021-02-24 06:40:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-07
MD5: e282392bfad3a7186c8d0a328b72e075 SHA-1: 47cafd5fb6412cedb13911c20e8ad8a404bc0ede SHA-256: 622de6c2fa7d01076af80b236fd1c4ab263fdefd6cb82529a8922120804e5284
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a lure related to Valentine's Day, directing the user to a suspicious URL. ClamAV and ML classifiers flagged this PDF as malicious, indicating a phishing or trojan distribution attempt. The presence of embedded URLs and the ML detection strongly suggest a malicious intent to redirect users to harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=lugares+para+salir+el+14+de+febrero PDF link annotation
    • http://openplafond.xyz/978863688791vmum.pdfIn PDF document text
    • http://rigipufefe.iblogger.org/ladotokuxoxixuji.pdfIn PDF document text
    • http://urott-hu.com/cute_images_of_baby_yodadnfr8.pdfIn PDF document text
    • http://exclusmxpn.com/frog_checkers_3d_modelff8wr.pdfIn PDF document text
    • http://tomandbxof.site/dufipifotolj0ixz.pdfIn PDF document text
    • http://citimart.online/lol_camille_guide_s8y1roz.pdfIn PDF document text
    • http://pressit.fun/annual_report_garuda_indonesia_2012pdxxr.pdfIn PDF document text
    • http://7lessons.fun/glidermatic_grd_user_manualf7qdg.pdfIn PDF document text
    • http://mexicotop.xyz/76374211647ch8tc.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/kijelopazekune/backuptrans_cracked_version.pdfIn PDF document text
    • https://s3.amazonaws.com/xugigabitulu/rojegevetoxedofajo.pdfIn PDF document text
    • https://s3.amazonaws.com/pegebunov/76020913281.pdfIn PDF document text
    • https://s3.amazonaws.com/lezopobigeza/62416853993.pdfIn PDF document text
    • https://s3.amazonaws.com/vufupu/ansible_template_file_copy.pdfIn PDF document text
    • https://s3.amazonaws.com/belopudevuzuza/jobotolenewuder.pdfIn PDF document text
    • http://tozibuxadotoba.epizy.com/sinuwilazede.pdfIn PDF document text
    • https://s3.amazonaws.com/sikuva/terraria_old_one_s_army_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/mixanaz/since_for_worksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/fukepez/60653255564.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d5a2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD5A2 5428 bytes
SHA-256: db5adfaac4b68cce37394ed2fc32f97099f85a0bc6fc2215a8c7cb5e9be7aa65
font_01_sfnt_off0000e831.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE831 12272 bytes
SHA-256: 4f0b287c3f85e181816af66b4e198da3c0202840093fca910b0c3f5b650dfa3e

Open this report in the interactive analyzer, or submit your own file for analysis.