Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ad5fa39c3cdaa94…

MALICIOUS

PDF

86.2 KB Created: 2021-04-15 11:02:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9f0bb6bde3974cba1f58d8a388556d8a SHA-1: 3c0d0f160bbbbb5bf873a83f2e52c4ecad8ec5ec SHA-256: 6ad5fa39c3cdaa944695448dd96391fc33ce8ea86007e0adec9f04c021a45f0d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. The ML classifier and ClamAV detection strongly indicate malicious intent. Although no scripts were extracted, the presence of external URLs and the nature of the PDF heuristics suggest it's designed to redirect users to malicious content, likely for phishing or to download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9954

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=tp+link+hs100+wi-fi+smart+plug+-+twin+pack+v2.1
    • http://bovizanaranofo.22web.org/banjo_kazooie_strategy_guide.pdf
    • https://cdn-cms.f-static.net/uploads/4499656/normal_606c98e2bb163.pdf
    • http://homearfes.com/durevamuwiretoliow1dv.pdf
    • https://cdn-cms.f-static.net/uploads/4484610/normal_6019966d0e7c1.pdf
    • http://vixitatevejiwo.getenjoyment.net/draw_the_shear_and_bending-moment_diagrams_for_the_beam_and_loading_shown_and_determine_the_maximum.pdf
    • http://ellmax-site.xyz/jafawogiyts7i.pdf
    • https://cdn-cms.f-static.net/uploads/4381740/normal_6054f572b1724.pdf
    • http://rodina38.ru/what_scares_u_the_mostwixz0.pdf
    • https://cdn-cms.f-static.net/uploads/4416496/normal_6054f60a6d3c8.pdf
    • http://fosireditoj.mygamesonline.org/asnt_ultrasonic_level_iii_study_guide.pdf
    • https://cdn-cms.f-static.net/uploads/4369802/normal_600d48701e1f0.pdf
    • https://cdn-cms.f-static.net/uploads/4493266/normal_5fd928d38f55d.pdf
    • https://static.s123-cdn-static.com/uploads/4366973/normal_5ffd005cb6a8f.pdf
    • http://xititarosoki.iblogger.org/tarshish_nineveh_map.pdf
    • http://tonagruz.ru/motorola_verve_buds_100s5p2y.pdf
    • http://tomogorman.com/rolesifonajoviziliv9hdr.pdf
    • https://static.s123-cdn-static.com/uploads/4453890/normal_5fcfaf8128075.pdf
    • http://subuxiwubemew.getenjoyment.net/2400052078.pdf
    • https://cdn-cms.f-static.net/uploads/4451217/normal_601f5974ee617.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://2c9641c8-5874-4869-9b94-f1378e60aa6b.filesusr.com/ugd/efc1f6_05ff2d17d69f4f6a8688f64d48b2734f.pdf?index=true
    • http://lofunadex.myartsonline.com/how_capitalism_saved_america.pdf
    • https://78bdfa25-736e-4945-a764-db21511aacb9.filesusr.com/ugd/9bd82e_e8cc20c01ef54b9ea5e7d802735b1531.pdf?index=true
    • https://f06ae689-34e6-4fd9-b749-a5985747e370.filesusr.com/ugd/4117a9_621a553db12840e8a2c4f5a11ca81bca.pdf?index=true
    • http://vuruketunuwu.epizy.com/pregnancy_low_back_pain_exercises.pdf
    • https://de2ee6d5-caaa-4265-b15c-40100ab77d99.filesusr.com/ugd/d43733_25b7a9378c4a404a885b2702cdaa628d.pdf?index=true
    • https://6b21c484-99f8-4e97-b77a-b77c054bfe5d.filesusr.com/ugd/f139d4_9c5ab993837c47d1aff03ab388d23794.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000100c2.bin
3566c3f22bfb842e6a506c19a46476e33ee13b61dd56263e89298a572b3eb44f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100C2 5636 bytes
font_01_sfnt_off000113da.bin
3e2913d4c9d0d94e0e22d267d1429bf059c5c4a285304aa6f16269844ed41468		 pdf-font-stream PDF embedded font (sfnt) at offset 0x113DA 11272 bytes
font_02_sfnt_off00013a5e.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13A5E 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.