Malicious PDF — malware analysis report

Static analysis result for SHA-256 66561e13e7238290…

MALICIOUS

PDF

92.0 KB Created: 2021-06-30 06:53:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 8a3812bacd6f608a2808dba6a39f3422 SHA-1: 11b6e2e9701a2670bca11f5f655d06323ee9d5dd SHA-256: 66561e13e7238290d76ed4f2b6d4b54e9c437b525f083b7dc4b7d640481f22c2
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains embedded JavaScript and external URIs, suggesting it attempts to redirect users to malicious sites. The presence of embedded JavaScript points to an attempt to execute code within the PDF, likely to facilitate the redirection or download of further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9955

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://estidevelopers.com/wp-content/plugins/super-forms/uploads/php/files/6f9ab1aa06fa9de9a9d3dcf9628981d7/18490245565.pdf
    • http://www.photobreak.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160ba77fb65429---wujotevifobevu.pdf
    • http://vipnjl.com/userfiles/files/jivawowalodupamabo.pdf
    • http://dui-antidote.net/images/userfiles/file/genodezivazojafefitusexel.pdf
    • https://ehblending.com/wp-content/plugins/super-forms/uploads/php/files/74e512654f75862cbadbe4832224f776/96321933218.pdf
    • https://advicezone.org.uk/wp-content/plugins/super-forms/uploads/php/files/2b3hcd7odpnsgeq6pilcoh8pem/kilomigudufivudad.pdf
    • http://www.birapart.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609e4f5d5c67a---99724654921.pdf
    • http://www.advancedevents.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1608042297628d---62854319381.pdf
    • http://springhs1988.com/clients/a/a7/a70db2535ed58991dd9724faf9b165d0/File/rinulusabonaxikugujonuduw.pdf
    • https://livingcircles.ch/wp-content/plugins/formcraft/file-upload/server/content/files/16097f61133188---49175377407.pdf
    • http://poltinka.ru/userfiles/file/37934988157.pdf
    • https://chicagoportablexray.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c9ae0b38e00---51117854986.pdf
    • http://legalinet.eu/userfiles/files/85944504045.pdf
    • https://expungemyrecordnj.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075f1902fd23---rorajunikitimo.pdf
    • http://willismctyeire.com/clients/c/cd/cd1fd5262213d36872a77bd42df049b7/File/fotem.pdf
    • http://bjoybrands.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d23dd2daf43---75006363796.pdf
    • http://www.leads-bd.org/app/webroot/js/ckfinder/userfiles/files/66043387638.pdf
    • http://ednak.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609d1a02ec7da---34365112544.pdf
    • https://g3az.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f17dfd82e6---larilepakepolemuzamoj.pdf
    • http://foto-klub.dk/userfiles/file/namavizezarifikodafo.pdf
    • http://aksaaydinlatma.com/img/editor/image/file/zapatefemiwigukoxib.pdf
    • https://feedproxy.google.com/~r/Uplcv/~3/Om9ozkHLxGw/uplcv?utm_term=chemistry+12+worksheet+4+4+ka+and+kb+calculations+answers
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e4bb.bin
ff509bc1bdbb406fb84e97817213cd6621872609d30c8332ac39201caef7834f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE4BB 19552 bytes
font_01_sfnt_off00011924.bin
034b4a31c649bfefcf558dbeb7bdc343140fc68754ac3ced3b70a57e397fb508		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11924 11448 bytes
font_02_sfnt_off0001343a.bin
505f1f16fb057e2a34e7666bb0a43a50f2e0b7bc0033e59b70183295ac12d2e9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1343A 16100 bytes
font_03_sfnt_off00014976.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14976 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.