Malicious PDF — malware analysis report

Static analysis result for SHA-256 6f35e42bc9c14ba9…

MALICIOUS

PDF

85.4 KB Created: 2021-04-16 20:34:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7613bc37e519596a38e23d8c829df376 SHA-1: 6b5d8abd6362fb685ae7019c6ed67f1999fa5239 SHA-256: 6f35e42bc9c14ba9dbe52ab2605d0fc1756c3cb503070a52f5d84e758bc21430
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, which is a common tactic for phishing or malware distribution. The presence of PDF-specific heuristics further supports its classification as a malicious PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=weider+crossbow+workout+machine
    • http://nurigoluda.mygamesonline.org/ap_grama_sachivalayam_key_paper_2020.pdf
    • http://sosed.market/39282275131cotbo.pdf
    • https://zejikato.weebly.com/uploads/1/3/3/9/133997407/gamina.pdf
    • https://fudolimag.weebly.com/uploads/1/3/4/5/134586879/womigugiwezu.pdf
    • http://sosed.market/159370784349c825.pdf
    • http://adminhalil.com/can_you_drive_a_commercial_vehicle_without_a_cdlj9dsd.pdf
    • http://jelusuvobirolen.mywebcommunity.org/i_ui_t_nh_sang.pdf
    • http://befujukipepejem.mygamesonline.org/60670444697.pdf
    • http://trixy-matrix.space/221588982872dfb7.pdf
    • http://xubajur.mygamesonline.org/after_tybalts_death_how_does_the_prince_punish_romeo.pdf
    • http://fisifur.iblogger.org/54532508602.pdf
    • https://dojilosadokadog.weebly.com/uploads/1/3/4/8/134890500/2927331.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://cb8582fb-ab29-4f13-bfd4-623ca244ab52.filesusr.com/ugd/d61b30_11b76606ebf24b4799ecc36ade8f7541.pdf?index=true
    • http://dinonikof.epizy.com/blank_biodata_form_free_download.pdf
    • http://kevowuju.rf.gd/news_intro_after_effects_templates.pdf
    • https://s3.amazonaws.com/tesodagiwor/archery_master_3d_mod_apk_unlimited_coins.pdf
    • https://s3.amazonaws.com/sivanira/molecular_shapes_chem_worksheet_9-_6_answers.pdf
    • https://69df74eb-9f83-488d-97bb-abb55063df61.filesusr.com/ugd/f34323_c01934cee6554bf89203f950f6e03cb0.pdf?index=true
    • https://s3.amazonaws.com/zoromexemuzid/bounty_hunter_tracker_iv_depth_test.pdf
    • https://46b09160-81f9-4cb3-9cca-f7b5b0c0229e.filesusr.com/ugd/179cc6_98ac819656bf4cf3aec9d382c5850130.pdf?index=true
    • http://gexepitirunagu.rf.gd/gekerimujasajatetuxiviwo.pdf
    • http://rivenoke.onlinewebshop.net/financial_accounting_tools_for_business_decision_making_7th.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010d16.bin
6d977726e622c7d8409728543c1c846765e932127dd967f1a093ea4731b06346		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D16 5456 bytes
font_01_sfnt_off00011f93.bin
33a8e523f356b1e6d4d9bf34b85880c4fe32da018c97519edd95d034b9f0a47d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11F93 11940 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.