Malicious PDF — malware analysis report

Static analysis result for SHA-256 6976f44a1e684213…

MALICIOUS

PDF

258.3 KB Created: 2021-02-10 03:26:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: ffac3dfcda32d7fc4dcb415901070921 SHA-1: ebcad65937c4a8d3c9ea53dcfc001ba142f97b76 SHA-256: 6976f44a1e684213211d0bb9a9556c87d2f74ea26fee5a610520e4285891fdf5
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. The ML classifier and ClamAV detection strongly indicate malicious intent. Although no scripts were explicitly extracted, the PDF structure and embedded URLs suggest it's designed to redirect users to malicious content, potentially for phishing or malware download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9921

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/wb?keyword=ancient%20india%20timeline%20pdf PDF link annotation
    • http://mudelukise.iblogger.org/xegemirebo.pdfIn PDF document text
    • http://reduslim-ordina.site/android_system_webview_disabled_in_piebdinc.pdfIn PDF document text
    • https://cdn.sqhk.co/pomorezolo/P4Xkijk/46455598028.pdfIn PDF document text
    • http://itayoga.space/divinity_2_original_sin_character_guide12hky.pdfIn PDF document text
    • https://cdn.sqhk.co/tezofugowura/mkAnKje/never_gone_extended_ending.pdfIn PDF document text
    • https://cdn.sqhk.co/kululojilo/ajehfBk/75473036617.pdfIn PDF document text
    • https://cdn.sqhk.co/puzadowoke/ogijigg/68884753395.pdfIn PDF document text
    • https://cdn.sqhk.co/diwelamu/gijdfyi/chinese_man_fishing_with_bird.pdfIn PDF document text
    • https://cdn.sqhk.co/sugezigo/iddZibM/menone.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4488807/normal_601611303e243.pdfIn PDF document text
    • https://cdn.sqhk.co/xawefigi/hgnheyd/fatez_unturned_zombie_survival_free.pdfIn PDF document text
    • https://cdn.sqhk.co/bapisolel/SOjggcQ/insights_app_for_instagram_android.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489244/normal_6014cc0461402.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403814/normal_6020908ec8b8f.pdfIn PDF document text
    • http://instup.xyz/math_teacher_cover_letterin3um.pdfIn PDF document text
    • https://cdn.sqhk.co/milagaleja/pjihaij/vosixesigifazikebibi.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4368251/normal_5fcedd3423dff.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://zakutipatijike.rf.gd/brain_entrainment_apps_android.pdfIn PDF document text
    • http://kefegaruxofum.rf.gd/chrome_setup_file_free.pdfIn PDF document text
    • http://wepirizifomonij.epizy.com/berliner_platz_2_neu.pdfIn PDF document text
    • http://sefakifag.epizy.com/morulideriwoxizizonenugu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0003a4c6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3A4C6 5016 bytes
SHA-256: b829e44c04c6f74f7039d93eb04bf5febb16cc69ea3d6beb1f41186fdad2cf07
font_01_sfnt_off0003b5cf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3B5CF 16432 bytes
SHA-256: 8eb1a925570c2573dfdf4e9366373d6281f32935b1edfa724250883984ce8b79
font_02_sfnt_off0003e556.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3E556 16116 bytes
SHA-256: 2a2db4f559f0f229cac65bcb4282087702fcdd9ff4c269c0872b13e038302a49

Open this report in the interactive analyzer, or submit your own file for analysis.