Malicious PDF — malware analysis report

Static analysis result for SHA-256 680f28f7c147bfe6…

MALICIOUS

PDF

68.3 KB Created: 2021-03-31 22:08:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 50536039de1226d93399e7f09a260f08 SHA-1: d8b8ea76a5bf01e92281051b7e7e6861c27995e1 SHA-256: 680f28f7c147bfe624d24d5207311b8c78e1980ea6c476f3f39534dde895fa66
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an external URI pointing to a URL that appears to be a search result for a technical manual, likely a lure. ClamAV and an ML classifier flagged this PDF as malicious, indicating it is likely a phishing or trojan delivery mechanism. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest it is designed to trick users into downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=microwave+engineering+pozar+2nd+edition+solution+manual+pdf
    • http://nokojatagi.mywebcommunity.org/jotetifawik.pdf
    • http://bebalezuve.medianewsonline.com/tebevakonak.pdf
    • https://xupubiwe.weebly.com/uploads/1/3/4/3/134339906/nepoluseguvazibebodi.pdf
    • http://gukevipagopu.mywebcommunity.org/article_370_in_gujarati_language.pdf
    • http://gojavodevagajuw.mygamesonline.org/daloz.pdf
    • http://pedron.fun/4563946857kb218.pdf
    • https://kavejujutafen.weebly.com/uploads/1/3/6/0/136022690/wirowim_lugowamov_mibew_suvovabosinoz.pdf
    • http://edaruzal.xyz/why_isnt_my_transmission_shifting9y6gr.pdf
    • http://craftsmansmetics.com/23726338539eo7r2.pdf
    • http://ravinugamajako.iblogger.org/agricola_revised_rules.pdf
    • http://bestrongbyg.com/admin_templates_bootstrap_4_2019cg8yo.pdf
    • http://sbrf.link/fogowifikinujoxo1q5j0.pdf
    • https://sezenoxesakibek.weebly.com/uploads/1/3/0/7/130740551/6353bd8c7f9e.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://memugeb.rf.gd/upper_michigan_fall_color_report_2019.pdf
    • http://venugowus.epizy.com/32998278306.pdf
    • http://pugalokero.rf.gd/o_que__carpintaria.pdf
    • https://6f8cb219-4830-455d-9ced-b55e65700e85.filesusr.com/ugd/fd30ac_03a3ae683b5e4f799bdda78d5cd4d400.pdf?index=true
    • https://c5c27394-2042-4749-9b39-d1c24dcbd9f0.filesusr.com/ugd/e9b987_12055ad6b6da440c8bd19893a03cca21.pdf?index=true
    • http://kizilobizewepog.epizy.com/alphabetical_order_worksheets.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000caf1.bin
245f8c3979a42615ef6d2d9dee448c6f2e55cdae56661cec5b0f269b0ce31bda		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCAF1 5816 bytes
font_01_sfnt_off0000ded8.bin
bd027a3325b637406b4922b67fca0acf6339e927c313105baaf06abc74f97025		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDED8 10368 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.