Malicious PDF — malware analysis report

Static analysis result for SHA-256 6a5502d698cdf3ef…

MALICIOUS

PDF

77.3 KB Created: 2021-03-22 04:36:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6a38ab1ce5fc044f2f4ceae818364ddd SHA-1: ee5b9cd905b15691aa540ece9ce106d3de36add6 SHA-256: 6a5502d698cdf3ef1f3a7a248633687f60cb9743cf35ecd277b1f904732259ce
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to deliver a secondary payload. The document body, though heavily obfuscated, suggests a lure related to 'learning german pdf'. No scripts were extracted, but the presence of external URIs and the malware detection strongly indicate a phishing or downloader attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/award?keyword=learning+german+pdf
    • http://ru-1.casa/52496904761r9x1r.pdf
    • http://futup.ru/vinevuvowjdrth.pdf
    • http://xopiredat.22web.org/mijufidimorunumo.pdf
    • http://rulimiwe.22web.org/lymphatic_circulation.pdf
    • http://triple-doska4.club/baby_bestiary_2_download_free4bw8q.pdf
    • http://wifejopoxakobo.iblogger.org/actiontec_q1000_bridge_mode.pdf
    • http://saratov.ooo/ariete_coffee_machine_manualzpw0z.pdf
    • http://numulul.mygamesonline.org/89240241602.pdf
    • http://fosonelotila.medianewsonline.com/resumen_de_cronica_de_una_muerte_anunciada_por_capitulos.pdf
    • http://xidufefonudug.sportsontheweb.net/toyota_camry_maintenance_schedule_2011.pdf
    • http://gikepofazanapol.mypressonline.com/vavela.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://guxozuzemonixe.epizy.com/jdk_1._6_64_bits.pdf
    • http://fexewagesulel.epizy.com/40812492236.pdf
    • https://50b7e5d6-ab0e-41ff-bbcb-47d024e5c277.filesusr.com/ugd/45d8ab_2289af649c814164a5851be1531a5775.pdf?index=true
    • https://e31b828f-dd5d-4b35-abba-5777d5fc2ed6.filesusr.com/ugd/56a8cc_5bb1b806f93649c88559e34bf57eb269.pdf?index=true
    • http://jepisaf.epizy.com/pajinob.pdf
    • https://f38be386-5799-403b-9303-fb121113655a.filesusr.com/ugd/6f1aa7_cbea45330fdd4579aa88637f6e3b23a7.pdf?index=true
    • http://devemakebelo.rf.gd/3201100417.pdf
    • https://2ddedb0e-b7b0-41c9-a8bc-c018bd0e6e4c.filesusr.com/ugd/70094d_b0b9cb49b7ad4bfaa11c5abf5c4db325.pdf?index=true
    • http://sasunuvelew.epizy.com/56448892949.pdf
    • http://fojeloga.rf.gd/nobafuxidosidukepafaj.pdf
    • http://talavapupaniv.rf.gd/divinity_original_sin_guide_for_beginners.pdf
    • http://xipijokezi.rf.gd/best_android_phones_under_30000.pdf
    • http://winikejotediteg.rf.gd/75032154121.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee6a.bin
d9bc3d3e9965acc246118a9df2fe33a759757c57910c7a39a99a7c48acaabe9b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE6A 5092 bytes
font_01_sfnt_off0000ffab.bin
dee53c185be590c8f941dad02a35c9ae4e10cf95f215396b58060896496cfb50		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFFAB 12144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.