Malicious PDF — malware analysis report

Static analysis result for SHA-256 65f1d070b8cbaa93…

MALICIOUS

PDF

73.0 KB Created: 2021-03-23 01:59:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 88df9a5642947b62a652e344a1540053 SHA-1: db83e0bd34fa4bc3a7b160ae4acdb32d1afcecbe SHA-256: 65f1d070b8cbaa93d059f18895443656b994722fe23213e82722c318283fe9f4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to a suspicious domain, and numerous other URLs were extracted, many of which are also suspicious. The document body, though heavily obfuscated, suggests a lure related to a product manual, aligning with phishing or malware distribution tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=electribe+2+sampler+manual
    • http://dayzcommunity.info/mexuxadigvz1cr.pdf
    • https://cdn-cms.f-static.net/uploads/4412891/normal_60108f6f53664.pdf
    • http://m-ryanaf.site/uscis_form_i-_90cqcwm.pdf
    • http://maewallace.com/xirupabonanakabozisa0n5le.pdf
    • https://static.s123-cdn-static.com/uploads/4391634/normal_5fefbeea5587a.pdf
    • https://cdn-cms.f-static.net/uploads/4446155/normal_60522299a9de6.pdf
    • http://springital.fun/dojiguk0kmd.pdf
    • http://sexesex.site/rifolobijebujoglq0qt.pdf
    • https://cdn-cms.f-static.net/uploads/4413013/normal_602b4b69c83b8.pdf
    • http://makamar.online/bhojpuri_gana_dj_remix_mein0qets.pdf
    • http://getbuiss.online/sarah_plain_and_tall_winters_end_movieb0wy2.pdf
    • https://static.s123-cdn-static.com/uploads/4456369/normal_600529d347f0e.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/93f782f3-296b-467f-b293-1351157d5914/keurig_instruction_manual.pdf
    • http://vaxusumimez.rf.gd/97519892240.pdf
    • https://uploads.strikinglycdn.com/files/4f5074bf-1c30-405e-8860-3f076044906c/68497849104.pdf
    • https://uploads.strikinglycdn.com/files/83f74db6-420c-4e24-b746-39543da42d90/totezobiraxujudadizagixob.pdf
    • https://uploads.strikinglycdn.com/files/5933f891-7f87-413a-9aec-6f880e482ecf/rowe_ami_jukebox_amplifier_repair.pdf
    • https://uploads.strikinglycdn.com/files/1ffaef60-4f0f-4b72-a26a-81c260e36880/43552069305.pdf
    • http://xidajar.epizy.com/florida_algebra_1_eoc_practice_test.pdf
    • https://uploads.strikinglycdn.com/files/f0bd88a8-0aab-43e0-b7a6-1e6bba1bdc9a/wopakuzanewim.pdf
    • https://uploads.strikinglycdn.com/files/180a0ea9-d0df-4b56-b537-a82d36ed6831/mr_coffee_5_cup_programmable_coffee_maker_walmart.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d3a1.bin
5e50678f282847ec7e6e26ec2f4df98267a50844cff3bdb0d891848c083d9583		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD3A1 5080 bytes
font_01_sfnt_off0000e4ba.bin
1a6f758c52af0a4de363bac652823d467dd92990e6b492cba4bc32f06b247a54		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE4BA 10144 bytes
font_02_sfnt_off00010743.bin
7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10743 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.