Malicious PDF — malware analysis report

Static analysis result for SHA-256 6a8ff974c90857a0…

MALICIOUS

PDF

76.8 KB Created: 2021-03-19 17:00:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3b3aecc24753dd7737ea44493d2ea477 SHA-1: bde25a1844708bace26443f120a2de87254abdf1 SHA-256: 6a8ff974c90857a0c7f5e87455882db0843a2d45172f81ef40c951d2b2a28452
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a suspicious domain. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware distribution. The document body, though heavily obfuscated, suggests a lure related to 'layout' or design, aligning with common phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=storm%2527s+end+layout
    • http://rubewox.sportsontheweb.net/mr_coffee_coffee_pot_cleaning_instructions.pdf
    • http://dejepuzalew.mygamesonline.org/karigemadujo.pdf
    • http://sunazeremitiwu.mypressonline.com/aluminium_alloys_handbook.pdf
    • http://jisijopimif.66ghz.com/ipcc_report_1._5_degrees_celsius.pdf
    • http://borutafag.66ghz.com/numozubokomoxuvazowijis.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/28fe996e-a4fd-410c-8d1c-b10e88c48b2b/female_breastfeeding_anatomy.pdf
    • https://s3.amazonaws.com/wewuxuviwar/sogefivuvelenujatelot.pdf
    • https://uploads.strikinglycdn.com/files/a987e381-2aed-4b7c-a9bc-3c4c0c553ed9/how_to_use_propresenter_7.pdf
    • http://tesoduv.rf.gd/xawikamixinerika.pdf
    • https://a146b927-ed54-472d-b3a8-6b137e313b92.filesusr.com/ugd/4d400c_b7ae3efce3fd4cdfa8e721c1ce0390cd.pdf?index=true
    • https://s3.amazonaws.com/xufoxorog/77151962465.pdf
    • http://suloxuboratofa.epizy.com/barajasidus.pdf
    • https://a22c3535-4c29-4f26-bf6b-1e631d3648e5.filesusr.com/ugd/28986c_f41bed01db734d90976f7275518989b8.pdf?index=true
    • http://bawujirilo.epizy.com/besharam_movie_worldfree4u.pdf
    • http://zepurudevivo.rf.gd/android_bitmap_auto_recycle.pdf
    • http://sajorasuxanuvil.epizy.com/building_information_modelling_in_canada.pdf
    • https://uploads.strikinglycdn.com/files/2df57544-9fd0-4608-9b1c-b3d856649ca9/is_it_safe_to_use_a_kerosene_heater_in_a_garage.pdf
    • https://s3.amazonaws.com/pisik/nova_3_android_9._1_update.pdf
    • https://d1159ab4-cbf5-42eb-897b-83a5e94cd7da.filesusr.com/ugd/536122_be97f9eeff6441c7b02a767ac7204dca.pdf?index=true
    • http://sadoboxijowem.myartsonline.com/annabac_francais.pdf
    • https://7afcd0b8-98df-42a4-afe0-9544d44c9539.filesusr.com/ugd/74e9cf_0c5888aa71a0466089cf994a8ad29ffc.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f408.bin
6e717cc04c6ba740b5a40d172ddcc6cd48dec2b94ce9e0d18f19d40657b3fed0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF408 5212 bytes
font_01_sfnt_off000105ae.bin
4e86bb572a87968dddbde457ca2cb2880ddeb6cfd1bf0915f152d2fdd6026791		 pdf-font-stream PDF embedded font (sfnt) at offset 0x105AE 9344 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.