Malicious PDF — malware analysis report

Static analysis result for SHA-256 6a40c32125ac4dd0…

MALICIOUS

PDF

76.6 KB Created: 2021-03-16 22:56:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 25e5687e53a9db809e68dee6b3dab196 SHA-1: 164edf643f2a56f11b960a294ecf825de617fd19 SHA-256: 6a40c32125ac4dd00aaecf880975154d6c4cc402d92aa5d8b7c40a266859da8c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. ClamAV and ML classifiers flagged this PDF as malicious, indicating a high probability of malicious intent. The document body, though heavily obfuscated, appears to be a lure related to Hitachi AC units.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=how+to+use+hitachi+ac+as+heater
    • https://cdn-cms.f-static.net/uploads/4374359/normal_6028b7cc580c4.pdf
    • https://cdn-cms.f-static.net/uploads/4403818/normal_6033fcfc4765f.pdf
    • http://famozosivupiwij.sportsontheweb.net/ropusokute.pdf
    • https://cdn-cms.f-static.net/uploads/4413244/normal_602bdc6a31d62.pdf
    • https://cdn-cms.f-static.net/uploads/4464311/normal_6041aab997b16.pdf
    • https://cdn-cms.f-static.net/uploads/4499995/normal_600c0f3ada4e5.pdf
    • https://static.s123-cdn-static.com/uploads/4418570/normal_5fc7abef1968b.pdf
    • https://static.s123-cdn-static.com/uploads/4381551/normal_6004aab48663e.pdf
    • https://cdn-cms.f-static.net/uploads/4482206/normal_600e9807d0746.pdf
    • https://static.s123-cdn-static.com/uploads/4367944/normal_5ff2d23a49a2c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/fidefofudi/fender_super_champ_x2_combo_review.pdf
    • https://uploads.strikinglycdn.com/files/2d33b718-f4f8-4886-9292-9091d045bdf1/bissell_powerforce_helix_replacement_belt_size.pdf
    • https://uploads.strikinglycdn.com/files/60b1bda5-6668-47b7-b45b-fd723464ff3a/singer_handheld_sewing_machine.pdf
    • https://uploads.strikinglycdn.com/files/684fddf2-e6a6-4c8f-ac3c-3424d7642d9c/mokonolapumoni.pdf
    • https://uploads.strikinglycdn.com/files/0c70f519-2199-4120-8f78-1a40a96c8afa/how_to_compute_dividend_income.pdf
    • https://s3.amazonaws.com/miwolezedubujoz/leprechaun_in_mobile_alabama_news_report.pdf
    • https://uploads.strikinglycdn.com/files/c968e8d6-782d-413b-97f0-701e54584896/how_to_rig_a_fly_fishing_rod.pdf
    • https://uploads.strikinglycdn.com/files/46e3cdfc-c0f3-4a0c-a9f5-8c689070908a/cuanto_mide_una_pulgada_en_mm.pdf
    • http://wojibikifi.myartsonline.com/how_to_live_life_after_divorce.pdf
    • https://uploads.strikinglycdn.com/files/abaec02b-53b1-4723-9435-6e5a67b1308b/taduvatonepil.pdf
    • https://s3.amazonaws.com/fotojipifuzitul/15767217278.pdf
    • https://uploads.strikinglycdn.com/files/ccebbbe5-8e00-4ed8-b607-f5a59fb14924/pofibekoxovovanemaxem.pdf
    • https://uploads.strikinglycdn.com/files/66999851-584a-4c27-b3aa-f580cb40cdb0/sanyo_dp26649_manual.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee2b.bin
dc9eaa881f4e9a0c4a693b8b16850a19fa847d26831d5015fa2232f6ba731f90		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE2B 4908 bytes
font_01_sfnt_off0000fee6.bin
bcc1245568977078c0ad4e7b804a02267d7153e45c656d939b8ebb6b2d4445dd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFEE6 10800 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.