Malicious PDF — malware analysis report

Static analysis result for SHA-256 62676a0db9a75c1b…

MALICIOUS

PDF

80.6 KB Created: 2021-04-01 03:03:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: da76708b436455f5426ecd0b008c2d9d SHA-1: 95caccd95b3f362e6c37cecfe883f40fa1b9ee89 SHA-256: 62676a0db9a75c1b6b4ba2f309d25e6be7f061476c24f44b50a0e1e7a43acfdc
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by multiple heuristics, including a critical ClamAV detection and an ML classifier. It contains an embedded URL pointing to a suspicious domain, likely intended for phishing or malware distribution. The document body, though heavily obfuscated, suggests a lure related to a 'complimentary ticket template', aligning with social engineering tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/123?utm_term=complimentary+ticket+template PDF link annotation
    • https://cdn.sqhk.co/zuronenom/kGq6qhc/olympics_2022_dates.pdfIn PDF document text
    • https://cdn.sqhk.co/fupupusamun/hjehjgc/download_hovercraft_takedown_mod.pdfIn PDF document text
    • http://kekijojovif.sportsontheweb.net/kivizanezoxuvopases.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446399/normal_601e47192bacd.pdfIn PDF document text
    • http://xogunajeraxuda.mywebcommunity.org/17716782030.pdfIn PDF document text
    • https://cdn.sqhk.co/wetaxawirewu/hj8hc5r/fozenerujaseripevategido.pdfIn PDF document text
    • https://cdn.sqhk.co/pumafuki/ghhgvjd/mesezorarabov.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369648/normal_60488fa571497.pdfIn PDF document text
    • https://cdn.sqhk.co/pafevola/hbjjJXI/wedding_cake_designs_near_me.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/b052190d-4da6-479f-9713-988b5e33931e/how_long_does_a_maytag_bravos_washer_last.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fa3ff61d-d0d3-4249-acaa-60b0a74452a6/zomewir.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/03e6cf9e-0e32-4564-ba60-aebab42c700d/medio_de_comunicacion_mas_usado.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/82ad0f83-b498-4e92-856a-8b82749dada1/tes_numeracy_skills_test_practice.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4b03a613-feaa-4506-9cfa-60c0cd658489/3614142337.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dc4d22da-ba38-46af-891d-586b9b0b5845/82489534229.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/685dc0b8-46b5-479c-92b3-8d7427cef1da/the_collection_trailer_2012_hd.pdfIn PDF document text
    • http://wazeniwemir.onlinewebshop.net/69268440510.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eb8d7f23-3b84-4d54-b490-3480af5e2338/electrical_engineering_degree_plan_pvamu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e2d7cc89-324d-46a3-a920-fae2ae397375/gogizikimol.pdfIn PDF document text
    • http://miganuvag.myartsonline.com/vuridojedibezidazowilurov.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6f7cad42-7655-4cec-b1eb-2da0fc02e017/retuv.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010068.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10068 4972 bytes
SHA-256: c28b59c5a0d3dfd767949a1cab31c70cbb01e90641596ab14d0fcf21d5a4dd37
font_01_sfnt_off00011141.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11141 10612 bytes
SHA-256: 5bd4468a40e199cc0ffa807051887b8cd6da1e799fb574807340531bfac31985

Open this report in the interactive analyzer, or submit your own file for analysis.