Malicious PDF — malware analysis report

Static analysis result for SHA-256 6c244ee3f43e2d65…

MALICIOUS

PDF

77.5 KB Created: 2021-03-03 07:29:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9bfc08d76ce0a3279a6509fe40554713 SHA-1: 9062e5bd120f17b2cadf433600a0456cedc43939 SHA-256: 6c244ee3f43e2d65908f440af5f96a40fb8cc19a8edbcd0a7b30799e57f7e6c3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that redirects to a domain associated with phishing. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or credential harvesting. No scripts were extracted, but the presence of a suspicious URL within the document body is a primary indicator of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=tarrant+county+warrants+lookup
    • http://naturalik.fun/lep_s_world_1_level_12_4moq04.pdf
    • https://gubuwogufulero.weebly.com/uploads/1/3/4/6/134608521/7703549.pdf
    • http://sejusadi.22web.org/25245912492.pdf
    • https://gedexezesojefib.weebly.com/uploads/1/3/4/6/134666283/sulepujidapa-mirat.pdf
    • http://romeoplanet.club/razer_blackwidow_ultimate_stealth_20136imm9.pdf
    • https://static.s123-cdn-static.com/uploads/4373527/normal_5ff7809884bf2.pdf
    • https://tekudijasefemo.weebly.com/uploads/1/3/2/7/132740256/8a78dd893c.pdf
    • http://harkateine.fun/26488015568pphdo.pdf
    • https://wadikojororewu.weebly.com/uploads/1/3/1/3/131398286/7858053.pdf
    • http://voztrans.ru/me_before_you_720p_hd_movie_downloadjp751.pdf
    • http://virnet77.ru/81408659985i5h5k.pdf
    • http://keksik24.ru/is_200_basic_incident_command_system_answersejtv5.pdf
    • http://excschool.ru/88937169401rqcyl.pdf
    • http://muslims.net/android_version_8.1.0_api_levelrmw1a.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/wajufifenoxuj/25444176937.pdf
    • http://tobesonev.rf.gd/latitude_and_longitude_worksheets_high_school.pdf
    • https://s3.amazonaws.com/wibedubosateg/3996991013.pdf
    • https://s3.amazonaws.com/xuxifuzituwu/murigibumikitotuzak.pdf
    • https://s3.amazonaws.com/tuxexi/xoxolovekijebuba.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f2b2.bin
429d7aab8299fe9cb2895457797ca15ff43ce1700b8e33fe9189d8a54690d75d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF2B2 5132 bytes
font_01_sfnt_off00010455.bin
4dab2f124e5cd457ba201050b14dc045e139332a9381cbc822278cfe8b895ee8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10455 10564 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.