Malicious PDF — malware analysis report

Static analysis result for SHA-256 62e55764c36a4c31…

MALICIOUS

PDF

68.4 KB Created: 2021-03-22 21:30:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: e567a6181edb1507f0db551fe8df836a SHA-1: 8106ac958885a0ed51260bfc157d947c07568c8f SHA-256: 62e55764c36a4c317b218ebbcbf466c080a0a72524020c12a493a22135456c4d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The document body, though heavily obfuscated, appears to reference a product, likely as a lure. The presence of an external URI and the ML classifier's high confidence score indicate a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/strik?utm_term=acer+aspire+e15+replacement+charger PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4407780/normal_5feee4354c879.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4495846/normal_6010fa945b48a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4393179/normal_5fdd7a67e465e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459328/normal_604f2fc0ad9f8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454048/normal_6009bc7b67919.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4456377/normal_600124124fec1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4402517/normal_603cb81be1ee7.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/75322c90-d892-4baa-88ba-9a744ad541c5/sowusesode.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7708210b-264c-4e6a-b752-0025a45f0706/letifikiremiwedol.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/df39f3bf-e302-4cda-8fe7-30d2f7c589c5/how_do_you_read_latitude_and_longitude_on_a_survey_map.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e5ba7020-84ee-4ec9-876e-234cac7a118e/xbox_one_controller_headphone_jack_fix.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b54c9690-3f21-4a74-a915-1345a1273b25/97667520077.pdfIn PDF document text
    • https://s3.amazonaws.com/jidosatikim/zosiw.pdfIn PDF document text
    • https://s3.amazonaws.com/baxunaf/dunno_mac_miller_piano_sheet_music.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/919438c1-93a6-45d1-9b23-5d3992a3dd00/carrier_weathermaker_8000_how_many_btu.pdfIn PDF document text
    • https://s3.amazonaws.com/rowubunak/lebiwi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0f51fc2b-4c0e-4e7e-b52a-c1bf9378ef7b/ergobaby_omni_360_review_singapore.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d9f02391-b838-4787-a266-fbdef5df6e8e/advanced_dungeons_and_dragons_monsters.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7962982b-d52f-4d7c-8df0-9f23943c1532/how_should_i_read_percy_jackson.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/749e195a-1f5b-490e-a591-1230e0103e29/what_happens_at_the_end_of_vampire_diaries_season_1.pdfIn PDF document text
    • https://s3.amazonaws.com/fomudebipefasu/aaa_travel_guides_canada.pdfIn PDF document text
    • https://s3.amazonaws.com/zevutebulaworel/software_quality_assurance_pressman.pdfIn PDF document text
    • https://s3.amazonaws.com/dejazuvorira/free_adobe_air_offline_setup.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cd11.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCD11 5512 bytes
SHA-256: f8b8217c7560aef2b0cd899c6f534cbfa99177dca35b7ad410b0510877e60596
font_01_sfnt_off0000dfb0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDFB0 10696 bytes
SHA-256: 5c893b01d2f9f424df9e81a31da5bae429d1e9f2d1b2aeefca9cc6e932654b9d

Open this report in the interactive analyzer, or submit your own file for analysis.