Malicious PDF — malware analysis report

Static analysis result for SHA-256 6f33db4506366d58…

MALICIOUS

PDF

68.9 KB Created: 2021-05-10 22:35:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 01b9e63437183327f39dc7ac9bbb5206 SHA-1: 876169156c74b020a24ffc260cc730432f33da6d SHA-256: 6f33db4506366d58c742151a5d648e271fb0cd5b07be335a8b4cf14e88f43abf
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of embedded URLs suggests a phishing or malware distribution attempt, likely disguised as a document. Although no scripts were explicitly extracted, the PDF structure and embedded URLs point towards a malicious document designed to trick users into downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.julitolaschools.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608e80df2cd25---xulumogedaxiko.pdf
    • https://fermuar.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608d7f6853a3c---xovij.pdf
    • https://mamproducciones.es/wp-content/plugins/formcraft/file-upload/server/content/files/1607f78e7b1437---95127055633.pdf
    • http://alnoorcity.com/userfiles/file/suvewe.pdf
    • https://notofthisgalaxy.com/wp-content/plugins/super-forms/uploads/php/files/1hqcac686uc2150oasuf2nvc3a/viputasovenafipowumatexa.pdf
    • https://transcendenceit.com/wp-content/plugins/super-forms/uploads/php/files/5514e28f497b8f8a0523c06449edf141/92017008336.pdf
    • http://hoondb.com/wp-content/plugins/formcraft/file-upload/server/content/files/16090dc575d274---98112716185.pdf
    • https://agrilaui.com/userfiles/file/vawezesenarejo.pdf
    • https://realestateconnect.biz/wp-content/plugins/super-forms/uploads/php/files/tjqe362bqk83ekr0ublomp0nk0/35098074113.pdf
    • https://senzedigicraft.com/wp-content/plugins/super-forms/uploads/php/files/1eb69ced5dbc6a4fc648b6f0bd6c909b/14677269430.pdf
    • https://www.allterra.group/wp-content/plugins/super-forms/uploads/php/files/b48644bd981769f015c47da340d26afa/39703188587.pdf
    • http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/16091d48975b2f---mijubikoguwovivuwegevadi.pdf
    • https://aldea.work/wp-content/plugins/super-forms/uploads/php/files/2ca8e74d150a3334e8ccb1df65b7696c/59059099766.pdf
    • https://thejasmineway.net/wp-content/plugins/super-forms/uploads/php/files/ifgijakp11hmv5ps2ca3ufvv31/99328018310.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/GLLx1DTH0VQ/uplcv?utm_term=bookmobile+app+android
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d210.bin
88ad17bf639a4bd2d2b33766195ce124087babcb94ccf63bbee3efeada265c11		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD210 5180 bytes
font_01_sfnt_off0000e393.bin
3e606fd4b388548b69a12b7ed6cfa329d4e98d0166e19b16ae6df688f98e3bd8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE393 10288 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.