Malicious PDF — malware analysis report

Static analysis result for SHA-256 62d7d1befc5e73cb…

MALICIOUS

PDF

85.4 KB Created: 2021-06-26 09:26:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 1c0d495d2dd20888b91de19af6305ecd SHA-1: 2681a7b82e4008baa0545d4b089deea9bf29f1a3 SHA-256: 62d7d1befc5e73cb1da92f74205a8410eb03b35229459fef00e7e5c5332d7a6a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded URIs that point to suspicious domains, indicating a phishing attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. While no scripts were explicitly extracted, the presence of external URIs and the overall detection profile align with a phishing lure, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9951

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://oniceh.ru/uplcv?utm_term=fun+builds+to+do+in+minecraft
    • https://sweetestspaparty.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c2cb5c58d1f---bupatovawuzunigebubit.pdf
    • http://www.kevinbrooks.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1607beb724df48---33911476565.pdf
    • https://luathoanghuy.com/uploads/files/84657072062.pdf
    • http://witnesstherealist.com/wp-content/plugins/super-forms/uploads/php/files/2251d00a9ed4ed78b703002b4517665f/denilamezazi.pdf
    • https://k2salight.com/wp-content/plugins/super-forms/uploads/php/files/e7e83af6ebf68df41ef1f9435ed618d6/vemulu.pdf
    • http://peoriamayorprayerevent.com/clients/1/16/166e3f524b51ec168ebfd48f86188a1d/File/sokibepofexadosirawinana.pdf
    • https://avonsteel.com/UserFiles/file/15599804246.pdf
    • https://www.advids.co/wp-content/plugins/formcraft/file-upload/server/content/files/160b8a4733dd29---nukofijolulafenixuwe.pdf
    • https://member-amz-seller-system.de/wp-content/plugins/super-forms/uploads/php/files/7709bd1b2d6c3e3babed8be9bd12a1ff/34524135361.pdf
    • https://www.darrellstuckey.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bd28c6f3240---54402057021.pdf
    • http://bukharaatlanta.com/sites/default/files/file/mimifikanumigega.pdf
    • https://www.mercedesbenzofaustinservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/16098adf21b40b---dorutufarolope.pdf
    • http://amfmeg.org/wp-content/plugins/formcraft/file-upload/server/content/files/160a3640bafac6---85283583010.pdf
    • https://cashofferoregon.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bfaa6814f24---mibogezamozomifajos.pdf
    • http://kystop.com/wp-content/plugins/super-forms/uploads/php/files/pcmo5bbiqmrlr2l9rm840qih15/74157391726.pdf
    • https://sharzh-ufa.ru/wp-content/plugins/super-forms/uploads/php/files/ca22b06fb7734c270688cdda941fa3d7/wezukunividadozogesidog.pdf
    • https://www.18fire.com/wp-content/plugins/super-forms/uploads/php/files/6eb92f36331a8da63a02903761dab5ea/tinoxupotufofulogajo.pdf
    • https://wpsqld.com.au/wp-content/plugins/super-forms/uploads/php/files/dbd5cf54af9d4850ce7c5ef64f4f1cb0/73363539516.pdf
    • http://geodeslaboratori.eu/userfiles/files/resesitefuxemigazunoze.pdf
    • https://cursosadistanciayonline.com/medios//files/xexizesaw.pdf
    • https://imapcb.org/wp-content/plugins/super-forms/uploads/php/files/j55uljubilfm5to7s2c1bdjkv0/ribamejebafewajodive.pdf
    • http://theopenhouseclub.com/wp-content/plugins/super-forms/uploads/php/files/17ef9c11f590746bde283a94d892189d/2301588008.pdf
    • http://xn--90ad5ackt1d.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/ae816c2c355e462b5f4316724db2de64/ruvomikolun.pdf
    • http://cleanyachts.it/writable/public/userfiles/file/bekofodofazoxibigososeve.pdf
    • http://gazosilikatnn.ru/uploads/files/34489067337.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec1c.bin
d0dabd5aa07287a0ba651b48981b9b215f3d446c398cc66a8a99a577d5ebf5fd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC1C 16672 bytes
font_01_sfnt_off00011768.bin
1e979c765981682b34d755f0d0025fc93dd038ae70cd01a45ed197d04aea3a18		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11768 10856 bytes
font_02_sfnt_off00013067.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13067 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.