Malicious PDF — malware analysis report

Static analysis result for SHA-256 66af88ec586df79b…

MALICIOUS

PDF

112.5 KB Created: 2021-04-04 02:28:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cb4a9867346c29486df720902962e23b SHA-1: d915f7503fd3644116a16131575191a509bb7629 SHA-256: 66af88ec586df79b3f530a2ef99ac8d9283e26ba37b3be0058ca98b427009216
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL, which is a common lure for phishing attacks. The ML classifier and ClamAV detection strongly indicate malicious intent. The embedded URL likely leads to a malicious payload or phishing page, attempting to exploit the user's trust by appearing as a relevant document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/award?keyword=complication+bronchiolite+pdf
    • https://petekebinipaz.weebly.com/uploads/1/3/5/3/135395272/4580804.pdf
    • https://kobipisi.weebly.com/uploads/1/3/4/3/134312725/4e620b42.pdf
    • https://cdn-cms.f-static.net/uploads/4416493/normal_601807fc5f09b.pdf
    • https://cdn-cms.f-static.net/uploads/4490140/normal_6018afc6dc3ff.pdf
    • http://mailedflkf.site/sefizegrzr6.pdf
    • http://gazozaxuk.getenjoyment.net/petuzotexuxezutevetaxes.pdf
    • http://canonsburglake.org/gumovebuse.pdf
    • https://bifixebuwo.weebly.com/uploads/1/3/0/7/130776276/ganesi_tosexufuxedej_vesemepej_golijivis.pdf
    • http://movawizaxaxato.mywebcommunity.org/37638170381.pdf
    • https://sepuzudagek.weebly.com/uploads/1/3/5/3/135329554/1623330.pdf
    • http://lenuvivureropi.scienceontheweb.net/47555179570.pdf
    • http://power-guard.shop/reloading_press_stands_for_salei7ir4.pdf
    • http://patedeziw.mypressonline.com/xuvidirorutat.pdf
    • https://vulemozebo.weebly.com/uploads/1/3/4/6/134693025/c6fc247ce7e.pdf
    • http://reduslimitalia-official.site/rabixedf5hm7.pdf
    • http://mx50off.info/32519655212z1p1d.pdf
    • http://gromstroy.com/3501495160vo6nd.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/d9074d8e-a499-470b-9646-37730180345d/96534686750.pdf
    • https://uploads.strikinglycdn.com/files/e241c89e-1d9e-4fea-af3b-f67cccf90d91/math_problems_for_4th_graders_division.pdf
    • https://uploads.strikinglycdn.com/files/ec5c839b-80be-458a-9477-88d5ce53e12e/how_fast_is_a_dodge_challenger_srt8.pdf
    • https://uploads.strikinglycdn.com/files/e36e1320-0fa5-452f-bb11-bca880ae1d36/1349031587.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00016183.bin
9c98a3b2cb7595ae63dbbcfc29cc19b3dee91ea8ce36a39896c3c6e97f41940b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16183 5260 bytes
font_01_sfnt_off0001732f.bin
7acc981fbe7f3f8c4d188f00089ff5254d7a1694459649507cfe7de92cd64fde		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1732F 13320 bytes
font_02_sfnt_off00019d2a.bin
99ddc6f5858eb134f8024171ebe717cbd02485c31471b921a5021903b5272953		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19D2A 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.