Malicious PDF — malware analysis report

Static analysis result for SHA-256 6357d7dc45829db0…

MALICIOUS

PDF

118.9 KB Created: 2021-02-15 05:47:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: 88b8f74aaa3c04f1d718c985b51c247c SHA-1: 57d87dfe5b29f4af9f3dc4c0b0f1a60b85f21c65 SHA-256: 6357d7dc45829db0660adca2efb9d44168c12137dcf4fc6993644226970daa97
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site. The document body, though heavily obfuscated, suggests a lure related to a keyboard manual, aligning with common phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=universal+wireless+bt+slim+keyboard+manual+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4379842/normal_5fd5fc58b7ea2.pdfIn PDF document text
    • http://richteam.site/723645915428ri4o.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4415740/normal_5fcdc82182188.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4485308/normal_5fc7142d34863.pdfIn PDF document text
    • https://cdn.sqhk.co/nigulavax/kMXhcjg/teloletafatizumusozo.pdfIn PDF document text
    • http://biomanix.best/postpartum_depression_quizh0m2h.pdfIn PDF document text
    • http://clobuss.ru/bozakupowupavoropujad4054.pdfIn PDF document text
    • https://cdn.sqhk.co/mugetawelumi/6jdgflk/49710486467.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4495999/normal_5fd86d8e3bf6e.pdfIn PDF document text
    • http://eferevole.com/chicken_gun_unblocked3yzmf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4470526/normal_5fdbc12ed990c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4385004/normal_5fd11ce8b4113.pdfIn PDF document text
    • http://avit0.pro/napowahgmr.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/wibadinavosunom/resignation_letter_due_to_ill_health_template.pdfIn PDF document text
    • https://s3.amazonaws.com/paxivogedewilu/fuwubarunafefuxot.pdfIn PDF document text
    • https://s3.amazonaws.com/tuxutedi/eso_crafting_leveling_guide_2019.pdfIn PDF document text
    • https://s3.amazonaws.com/xovekolamoxe/web_data_mining.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00016cdf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16CDF 3204 bytes
SHA-256: 22fcfe9081fa7b9478c29cd4299b4faccd7e97c248121b876da635f3a9edfbfa
font_01_sfnt_off00017844.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17844 5520 bytes
SHA-256: dfd0f08d8f7700fc2bd82c6a81b5bddd840e658c7257ed4dc6412a675b9dd247
font_02_sfnt_off00018afc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18AFC 16280 bytes
SHA-256: 260ea0c737ee36cf25c64996c264cc6eaeefaff418dcd0e3cb5dabfdf7ad989f
font_03_sfnt_off0001bd43.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1BD43 4324 bytes
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378

Open this report in the interactive analyzer, or submit your own file for analysis.