Malicious PDF — malware analysis report

Static analysis result for SHA-256 6f615295672f6ac5…

MALICIOUS

PDF

73.5 KB Created: 2021-06-09 17:26:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 416af98807f70a17212c9989cb87c057 SHA-1: 6881999b87bef04a56f0094b96399c9917804302 SHA-256: 6f615295672f6ac54fdb7bb66c43b8a7159458fe33a3bd85dd10e5a1192fbb46
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.Trojan' and an ML classifier indicating maliciousness. An embedded URL points to 'infrive.ru', suggesting a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and embedded URI are strong indicators of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://infrive.ru/pbw?utm_term=git+commit+revert+last+commit PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4447108/normal_601f818243f28.pdfIn PDF document text
    • https://static.s123-cdn-static-d.com/uploads/4465252/normal_60b3483a2e09b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421613/normal_602cf5aa6c364.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4467007/normal_606930420de24.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4428039/normal_5ff3f0e763a61.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449974/normal_60bd83b95b091.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4490377/normal_606d2aacab85a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4464083/normal_60664d308277d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4475734/normal_603d6feeae4b3.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/fab96a62-3674-4d55-a2de-a67d638cacc8/73057140999.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/59610e67-ff18-4e06-96b6-b97d195eff97/44226658077.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/033036e2-5151-4ae3-8e6a-7f030dcd1ba0/39487240351.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1ca02df7-8021-49c8-9851-71a9b16ddd44/vida_y_hazaas_de_alejandro_magno.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8ac17289-8a78-4ff8-af05-001ab66b6f39/94451034786.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b7b38fd3-7b3f-43af-b76f-85e14032de2a/9045952100.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1dc8736d-28cc-478c-8408-15dba0df0ba7/baofeng_uv-5r_beginners_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/54be171c-7f83-4ebb-8723-11ec1a4b3c83/tusapisenetakasabiw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8e6ab914-c2c3-4ba6-8d44-fb260578081f/8212383762.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f2416f9c-1818-4164-8fba-982e0b6e3396/ambari_kannada_movie_songs_free_download_123musiq.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/621441c9-a7e8-40e4-800e-c7d0e77722f8/how_to_use_the_spiritual_gift_of_discernment.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9098af2e-3a3e-4147-8400-85576c094ddc/rilasufumatadakuzobe.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dcc8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDCC8 5036 bytes
SHA-256: 290395f1d4c149062acb8ad8de2056458175cc032305397af81c9cdd49e1683c
font_01_sfnt_off0000edd3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEDD3 12176 bytes
SHA-256: 0c30cb7f77035f4a1ab02465e2e604edeb8491555d32e3e7a271ab1d2eadc8da

Open this report in the interactive analyzer, or submit your own file for analysis.