Malicious PDF — malware analysis report

Static analysis result for SHA-256 68582b0db03b0aef…

MALICIOUS

PDF

75.5 KB Created: 2021-05-01 23:27:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a1df45347e1d33a2915a506c19af4643 SHA-1: 761ba4a85d9609738b78328433350946af79ecf7 SHA-256: 68582b0db03b0aef38f85e7cd8971d8f7f44b0c4711016e4a7de084a2d523c70
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as a malicious PDF by ML classifiers and ClamAV, indicating a phishing or trojan payload. The embedded URL points to a document disguised as a vehicle owner's manual, likely intended to trick the user into downloading further malicious content. No scripts were extracted, but the PDF structure and heuristics suggest a malicious intent to deliver a payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.oschouston.com/osc/wp-content/plugins/formcraft/file-upload/server/content/files/16074b96587a58---24399405315.pdf
    • http://www.immiflex.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075b4c16c0fb---wajix.pdf
    • https://www.nrlandscapes.co.uk/wp-content/plugins/super-forms/uploads/php/files/5a44345f9647582182c423ce3339ddd8/2141436856.pdf
    • https://www.cr-sdc.org/wp-content/plugins/super-forms/uploads/php/files/17ded69a3f6e3ee9ac1118f97cfb39bf/zasumilupomeberu.pdf
    • http://www.fliesen-brill.de/wp-content/plugins/formcraft/file-upload/server/content/files/16075880d9a39e---32130631992.pdf
    • https://k-kompany.ru/wp-content/plugins/super-forms/uploads/php/files/029640a10bd98a0dc05bd21149b60b6b/dexuzitepudi.pdf
    • http://ampletrekking.com/userfiles/file/galodu.pdf
    • https://1sis.com/wp-content/plugins/formcraft/file-upload/server/content/files/160846fcca1cff---kegimubekemumovam.pdf
    • https://www.brightfieldbusinesshub.co.uk/wp-content/plugins/super-forms/uploads/php/files/na3gavteti1n7efbfn93peck35/16027115128.pdf
    • https://www.bistro-e.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606cee431271f---lovogibiregoxurupawaduwip.pdf
    • http://fantasypartyentertainment.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083b36fb6448---20640527868.pdf
    • https://propbrains.com/wp-content/plugins/super-forms/uploads/php/files/fv04g1kh62ajrokg4cptskngu1/37434547116.pdf
    • https://www.diktu.com/wp-content/plugins/formcraft/file-upload/server/content/files/16080599f33c16---70806051035.pdf
    • https://foxtailmag.net/wp-content/plugins/super-forms/uploads/php/files/190c44cebe3d69acb749957750112ae0/34316060760.pdf
    • https://remoteworkerclub.com/wp-content/plugins/super-forms/uploads/php/files/f2c74fbaa0b38c55a82a521269efdf29/44169460505.pdf
    • https://www.actionconstructionjax.com/wp-content/plugins/super-forms/uploads/php/files/0a95d89e449e2fee8814da2b6ec755c9/79192379630.pdf
    • https://sdyh.gr/wp-content/plugins/super-forms/uploads/php/files/dek78963a05l7m931aqnmstqp1/79778427165.pdf
    • http://www.mtpartnersfl.com/wp-content/plugins/formcraft/file-upload/server/content/files/160730c6ba4521---99243731647.pdf
    • http://www.vitrierbxl.be/wp-content/plugins/formcraft/file-upload/server/content/files/1606f662293d8a---51139775123.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/Uplcv/~3/A3Ryygt5BCM/uplcv?utm_term=kia+cerato+2011+owners+manual+pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e78e.bin
b9bee6ee55214135212b5d8416f786b5273f0c879b995c3ea9ae0e874a13d5de		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE78E 5688 bytes
font_01_sfnt_off0000faf7.bin
93942b53aa72bfc25874ea82004a6f4c751477be692435ddba762f9140ee54ca		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFAF7 11104 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.