Malicious PDF — malware analysis report

Static analysis result for SHA-256 632bad666d698d4a…

MALICIOUS

PDF

79.1 KB Created: 2021-03-21 11:13:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e9dbfc1425ecaf94f678b8ca17fbe33f SHA-1: 5bb4e97842e0ddea6b9b1c225219056c1dafffa5 SHA-256: 632bad666d698d4a6d830656338bf0c5f44df2356b1d3252534791d550213679
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a suspicious domain, disguised with keywords related to the Black Panther Party. This suggests a phishing or social engineering attempt to trick users into visiting a malicious site. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for credential harvesting or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=black+panther+party+ten+point+program+pdf
    • https://cdn-cms.f-static.net/uploads/4487399/normal_5fd915d3b4a83.pdf
    • https://cdn-cms.f-static.net/uploads/4459640/normal_6025903635f29.pdf
    • https://zaranofe.weebly.com/uploads/1/3/5/9/135967679/juxaxuzuse_zidazexifud.pdf
    • http://nipokaxa.getenjoyment.net/why_do_looks_matter_in_society.pdf
    • http://bosemefawixuwov.mypressonline.com/dodogumevivaratujumibebor.pdf
    • https://warevinigipa.weebly.com/uploads/1/3/4/8/134898994/9930227.pdf
    • https://cdn-cms.f-static.net/uploads/4411481/normal_602d3ecdb4b20.pdf
    • https://static.s123-cdn-static.com/uploads/4366400/normal_6006eb9e328f9.pdf
    • https://wowaximemufa.weebly.com/uploads/1/3/1/4/131453960/mimetinena.pdf
    • https://wunabigoji.weebly.com/uploads/1/3/4/8/134891590/bawogosurilekatitir.pdf
    • http://didibemez.scienceontheweb.net/how_does_third_person_point_of_view_affect_the_reader.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/45236f6a-a7c2-424e-a620-075a24044f88/tribe_on_homecoming_and_belonging_chapter_1_summary.pdf
    • https://uploads.strikinglycdn.com/files/ed5ebae3-3caa-4434-89e9-d8ca8c950784/vobetabag.pdf
    • https://uploads.strikinglycdn.com/files/35fc2289-56cb-4a62-bb5d-4da190da3448/the_stranger_book_harlan_coben_series.pdf
    • https://s3.amazonaws.com/ladojenefe/casio_ae_1200wh_manual.pdf
    • https://s3.amazonaws.com/jusuberu/96530332989.pdf
    • https://uploads.strikinglycdn.com/files/f830c906-5847-45be-b1b5-4087af97736a/panasonic_telephone_batteries_cordless.pdf
    • https://s3.amazonaws.com/vasofirida/charts_and_graphs_templates_free.pdf
    • https://6b5d12f1-3bbc-48af-9ddb-5430d2fe15e7.filesusr.com/ugd/3bf302_96a36185e1bc4f70ac80b13d1c5cc744.pdf?index=true
    • https://a1d1c4ac-cf1d-4c58-861c-45d1188f4b60.filesusr.com/ugd/052f3a_7d0172cbd6c04842a42e4f0a50e49575.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f811.bin
8038aa08aa0e69959c7bacafa3420a9ab786040cffa9447458a5f7a9cacfba4d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF811 5608 bytes
font_01_sfnt_off00010b0a.bin
9a695909549d77aab0e2035fdd557a60065498814188655bc128c82ccf9362e0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B0A 10592 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.