Malicious PDF — malware analysis report

Static analysis result for SHA-256 69d27328368a4c5b…

MALICIOUS

PDF

74.2 KB Created: 2021-03-30 11:03:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: fd297bafeaf780c30e84314db46f2a8a SHA-1: ff3a0e126634fa54f0a602454e80dd37c2caf629 SHA-256: 69d27328368a4c5bb132d0803db1efbd2681af430adcc0aec621b1cb66cc99e1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The embedded URL points to a suspicious domain, suggesting a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are consistent with common phishing lures.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=why+you+should+not+eat+fast+food+persuasive+speech PDF link annotation
    • https://cdn.sqhk.co/kupujape/wSjiZVJ/gexiwig.pdfIn PDF document text
    • http://pijojavoto.mygamesonline.org/simawilalanasobabuwuvi.pdfIn PDF document text
    • https://cdn.sqhk.co/nukuzulu/idoifvU/9803839871.pdfIn PDF document text
    • https://cdn.sqhk.co/dedenijikal/modigih/stud_bolts_and_nuts_dimensions.pdfIn PDF document text
    • https://cdn.sqhk.co/filumabit/gjXuMjc/fotaloxafelativefabiditob.pdfIn PDF document text
    • https://cdn.sqhk.co/zupisopad/heudjd6/95733653889.pdfIn PDF document text
    • https://cdn.sqhk.co/jowapezo/D4jABih/download_arma_tactics_demo_mod_apk.pdfIn PDF document text
    • https://cdn.sqhk.co/pirujezexod/hfYgiqu/exxon_stock_market_chart.pdfIn PDF document text
    • https://cdn.sqhk.co/zinoliwomi/pjcmjjx/levupugenujorejefesaj.pdfIn PDF document text
    • http://jolixasij.sportsontheweb.net/is_there_a_tennis_game_for_ps4.pdfIn PDF document text
    • https://cdn.sqhk.co/jipodipotaj/uicbfia/numuto.pdfIn PDF document text
    • http://fulifubajamo.mywebcommunity.org/annual_report_of_wipro_2020_17.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/12fb3eb0-d832-45d0-9015-f3bded4f0e27/72122079138.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9398faa8-ac48-4910-a00f-c9bdfe784fdc/56816700993.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5c17d350-ee23-4a59-886d-9be9eb34ca78/wahl_colour_pro_cordless_clipper_manual.pdfIn PDF document text
    • http://pedamodaw.onlinewebshop.net/liramoguzojigodov.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cce91c02-2344-4750-868d-6f5a7701950f/tim_ferriss_tribe_of_mentors_book.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/386b7928-f998-4e02-a258-42166b2a9a06/33_days_to_merciful_love_online.pdfIn PDF document text
    • http://bitines.myartsonline.com/amana_80_sse_air_command_gas_furnace_reset_button.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7d1870df-9038-48cd-b008-7eb9423eba8a/shaded_red_dachshund_puppy.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2de0d01e-efc9-4461-88c8-f50ec29e3640/35843411860.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e2f2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE2F2 5416 bytes
SHA-256: 683f130be9d8dadf3801aae464aadc030c432fbba406fc314c480e5d1256b3da
font_01_sfnt_off0000f575.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF575 11116 bytes
SHA-256: c7b6f0e5180edfa70d62cf9c1210719181df4099a59a39e0a98c6d54aecf21c4

Open this report in the interactive analyzer, or submit your own file for analysis.