Malicious PDF — malware analysis report

Static analysis result for SHA-256 6b5af18bf72bdcfb…

MALICIOUS

PDF

69.8 KB Created: 2021-03-22 21:03:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f341981aeb01fb5e0dc7cdb4c2571bba SHA-1: ef529b7c2064fb0a41f1b546bf9fa1f489f1b041 SHA-256: 6b5af18bf72bdcfb8af3db2075934c87c9742dad75ef41f9a8a58e05850c7a05
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or trojan payload. It contains suspicious links, including one disguised as an Instagram support page, which likely leads to a second-stage download. The document body, though heavily obfuscated, suggests a lure related to product information.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image-heavy PDF with invisible link to suspicious domain high PDF_SUSPICIOUS_LINK_LURE
    PDF is a small image-heavy lure with invisible link annotations that send the user to a suspicious high-risk-domain URI. This matches credential-phishing carriers where the visible document is only a prompt and the real collection flow happens on the linked website.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/aws?utm_term=swingline+heavy+duty+stapler+%2523800+staples
    • http://pe50off.info/ninja_blender_black_friday_2020_dealsehgis.pdf
    • http://lnstagram-support.live/android_oreo_iso_for_pc6xapt.pdf
    • http://zabavnyi-slon.ru/lfs_araba_yamalar_tamindir6gfx6.pdf
    • http://shishkin-seed.xyz/fipujeratewoniuq361.pdf
    • https://vedegidimojota.weebly.com/uploads/1/3/4/5/134597995/betuza_pokewogikusub_xopuk.pdf
    • http://naturebiolog.fun/54868982455offc7.pdf
    • https://feposogasutam.weebly.com/uploads/1/3/1/3/131384530/jirufetazeze-xetupetiwe-dodis-lalibemuda.pdf
    • http://deflecfcvy.best/python_tips_for_beginners_reddityyp6b.pdf
    • http://aazzzry.space/98844189575se980.pdf
    • https://rukepeninosiwul.weebly.com/uploads/1/3/1/4/131406291/e8b3693846.pdf
    • https://zexamedoguko.weebly.com/uploads/1/3/1/4/131454027/8774583.pdf
    • https://sisaravebopaz.weebly.com/uploads/1/3/4/5/134590876/pejezafuligatafasozo.pdf
    • http://neliwiveles.22web.org/61055557070.pdf
    • http://rineset.xyz/sample_php_website_templates_free_downloadohmi0.pdf
    • http://tublitalia.fun/83185140446lpyfj.pdf
    • https://dogerisu.weebly.com/uploads/1/3/0/8/130874322/5695044.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/kokesatodixon/fifenaped.pdf
    • http://vemevusakeke.epizy.com/dusijesapi.pdf
    • https://s3.amazonaws.com/sesijesule/nuance_power_shows_trial_watermark.pdf
    • https://s3.amazonaws.com/rodigapigeta/rulelupolaboxewasuxup.pdf
    • https://s3.amazonaws.com/xenavuxa/31301008293.pdf
    • https://s3.amazonaws.com/sutawowirosuvuv/gazosa.pdf
    • http://murarefap.epizy.com/peking_university_international_student_guide.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cf8d.bin
d6be48509dd186d81b018f6aad076989740854fbc9a8ebe55f5d8e38c28c5877		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCF8D 5576 bytes
font_01_sfnt_off0000e29e.bin
7a4d68f635713276c0771fe305dfd6e160095d3476d60066f84a28bbbe0f9c05		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE29E 11160 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.