Malicious PDF — malware analysis report

Static analysis result for SHA-256 62e08a5edcc026eb…

MALICIOUS

PDF

107.8 KB Created: 2021-03-28 11:13:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 97e32a5dd76fae67fa23c5f1c22591a2 SHA-1: 7dc0977f8b00101be8e2f3b71239376cdfa97266 SHA-256: 62e08a5edcc026eb3db7d4590d3bc13f422ed5b3cf1ce419b44053048b29ea5f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though partially corrupted, suggests a lure related to 'Brooklyn tech absence form', aligning with a phishing attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/123?utm_term=brooklyn+tech+absence+form
    • https://cdn.sqhk.co/wodelaganav/3yKxiee/984241307.pdf
    • http://reduslimitalia.site/36774516194kzcyp.pdf
    • https://cdn.sqhk.co/mawejoxejobe/YInnNgg/hellofresh_trial_box_uk.pdf
    • http://praktika-ingenieur.com/tisulugovazatumojxji74.pdf
    • http://betflixguvenilirmi.com/jlab_executive_earbuds_manualjwkpn.pdf
    • https://cdn.sqhk.co/fopikudapom/iTgiEJ5/table_tennis_around_me.pdf
    • http://yandex-dostav.ru/how_to_fix_f10_error_on_kenmore_ovenrmagb.pdf
    • https://cdn.sqhk.co/zaliroded/fFjthcT/nuxosuvenevesikuz.pdf
    • http://jolamuvinuma.iblogger.org/balamuxidutodew.pdf
    • https://cdn.sqhk.co/mewovegid/fKLcTij/musuwuvutepukovasu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/sefiwegegagu/89242608811.pdf
    • https://s3.amazonaws.com/tubukeganuji/motu_patlu_cartoon_movie_mp4_3gp.pdf
    • https://s3.amazonaws.com/votubukaxogilix/agorafobia_definicion.pdf
    • https://uploads.strikinglycdn.com/files/2069ea1f-80c4-4f58-a062-dcee82652a19/25933659583.pdf
    • https://s3.amazonaws.com/resixexi/radio_broadcasting_software.pdf
    • https://s3.amazonaws.com/tikoweravisixu/el_aborto_texto_argumentativo.pdf
    • https://s3.amazonaws.com/jijari/chick_fil_a_menu_nutrition_guide.pdf
    • https://s3.amazonaws.com/novifamigot/heat_transfer_text_book_download.pdf
    • http://zoxuditavuvov.rf.gd/firefox_52._9_esr.pdf
    • https://s3.amazonaws.com/legobegutulo/15187431327.pdf
    • https://s3.amazonaws.com/tawovojo/jorinijugasekagakafezas.pdf
    • http://fomobiwudaz.rf.gd/74113004790.pdf
    • https://uploads.strikinglycdn.com/files/d5323703-8305-48aa-9515-03c3545d6a7d/vumovuvavanekafejuw.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00015a10.bin
e119440bb9bc865d17fb6d3292b48bfa8c2e7dd2b031f34bfedbc6e6cd7cc768		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15A10 5216 bytes
font_01_sfnt_off00016ba4.bin
896805205ed478a9039377d4da5198f2216bc5bcabd70d76875d7e278c039363		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16BA4 11936 bytes
font_02_sfnt_off000193dc.bin
a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x193DC 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.