Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ef05c924ae5a6e2…

MALICIOUS

PDF

76.5 KB Created: 2021-03-31 14:08:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 97bb729d1f220abd47954ca86ae424ad SHA-1: a9f9a338942fb470a7cc633d5e58a6b36b960ba9 SHA-256: 6ef05c924ae5a6e20b6c1e958877f27c16ffced0d1226545244ae1a42bf444c3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to real estate ethics, further supporting a phishing attack vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=realtor+code+of+ethics+preamble
    • https://cdn.sqhk.co/rabuzopat/jicgejg/tripp_trapp_harness_new_model.pdf
    • http://gupirigugorixuf.sportsontheweb.net/71898730619.pdf
    • https://levavago.weebly.com/uploads/1/3/5/3/135343263/xawas-jolalovefijum-nanozu-populajebakefo.pdf
    • http://ruguwafe.scienceontheweb.net/liftmaster_8355_vs_8365.pdf
    • https://fupuvoriru.weebly.com/uploads/1/3/4/4/134494751/fumosajedo.pdf
    • https://nutagabe.weebly.com/uploads/1/3/5/3/135325028/3649948.pdf
    • http://keepmaxi.space/zoduzokivufutopusifigae4ck5.pdf
    • https://cdn.sqhk.co/merisipugito/jgYgf78/detewetojakagixol.pdf
    • http://favodokoleti.mypressonline.com/latexukotanaketa.pdf
    • https://danexuxubusam.weebly.com/uploads/1/3/2/6/132695747/xiwogavuf.pdf
    • http://mrshadow.net/robin_hood_disney_whistle_song_chords8zqaf.pdf
    • http://bowuvudofi.scienceontheweb.net/rositofagup.pdf
    • http://rijexofugovu.medianewsonline.com/eleven_rack_expansion_pack.pdf
    • http://walolexokesufa.sportsontheweb.net/75345229278.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/fb7f0b0a-f775-41de-bb71-8289bd7a598b/69856796594.pdf
    • https://uploads.strikinglycdn.com/files/dc178693-33e0-4d38-9e7d-f851f231efc2/gutenberg_bible_english_translation.pdf
    • http://jelunegizubu.atwebpages.com/movawapiwagumetakizada.pdf
    • http://birukuf.onlinewebshop.net/watch_the_white_princess_episode_7_online_free.pdf
    • http://sudexixurijaxoz.atwebpages.com/archangel_s_storm_free_download.pdf
    • https://uploads.strikinglycdn.com/files/27fe2f0b-1b9e-402f-abe4-f3028b56d1ad/que_es_la_historia_natural_de_la_enfermedad_oms.pdf
    • https://uploads.strikinglycdn.com/files/dce335c4-7989-40f1-b0c5-dde928897e7e/stihl_ms310_replacement_parts.pdf
    • https://uploads.strikinglycdn.com/files/90e06402-4d83-44e1-ad9e-68282e2fddc7/base_rate_neglect_finance_definition.pdf
    • http://nobapizasiwe.myartsonline.com/68423369447.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eba6.bin
dd5d77f8e755c8f0822e7c730b13aabe95ee4bd2c4352a99e2299ddb957496c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEBA6 5540 bytes
font_01_sfnt_off0000fe51.bin
16fc50660f3478e45a47a03e8cc2069c33ed7acac8f6a15eb0955304ee246566		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE51 11732 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.