Malicious PDF — malware analysis report

Static analysis result for SHA-256 6f6391ad72f499ad…

MALICIOUS

PDF

81.7 KB Created: 2021-03-19 18:31:25 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7b0b150919e90b813c65743f0a0ec605 SHA-1: dec23a550045897c3db34494439c99fb1e3028a5 SHA-256: 6f6391ad72f499adb0d29c596ae7ec958a5ee724b49ca95261772379228a92f3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. The document body, though heavily obfuscated, contains text suggesting it is a lure for search terms, and an embedded URL points to a suspicious domain. The presence of PDF-specific heuristics and the overall detection profile strongly suggest a phishing or trojan delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/wix?keyword=vocab+level+g+unit+3+synonyms+answers
    • https://static.s123-cdn-static.com/uploads/4418197/normal_5ff115b2820c2.pdf
    • http://sagunutu.medianewsonline.com/21094012844.pdf
    • http://osummer.space/85305993937vvkr2.pdf
    • http://silvanozito.online/garmin_etrex_30_gps_specificationst0ceg.pdf
    • http://zahlungsservice-ch.site/konovikogegi2hpgo.pdf
    • http://viputixezererej.66ghz.com/66363247703.pdf
    • http://modezewop.mygamesonline.org/practica_de_destilacion_por_arrastre_de_vapor.pdf
    • https://cdn-cms.f-static.net/uploads/4472788/normal_601fff82344ac.pdf
    • http://matcobzor.ru/how_fast_is_the_polaris_sportsman_xp_1000_ssnud0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://aed0ee3a-d217-4696-a563-de9ff15d6c37.filesusr.com/ugd/f80e3f_576596286c9c4eca9d01fdfd2c41d903.pdf?index=true
    • http://soriwolawiri.epizy.com/the_apocryphal_gospels_definition.pdf
    • http://zopoxasemegivo.epizy.com/80367438676.pdf
    • http://jinonepi.epizy.com/93616982731.pdf
    • http://zelawiture.epizy.com/duraflame_portable_heater_manual.pdf
    • https://1bf92926-22d0-44a1-94fb-b51843c41cd5.filesusr.com/ugd/762c1a_e1cffb3e5fd04f0abc410dee6627ffe9.pdf?index=true
    • http://monawob.epizy.com/the_artist_s_way_morning_pages_journal.pdf
    • http://jikebejilogotum.rf.gd/muvapelapokox.pdf
    • http://pelebirepopo.onlinewebshop.net/80922627708.pdf
    • http://lubesugoninop.epizy.com/tamoxifen_dosage_form.pdf
    • http://tarepos.onlinewebshop.net/rheem_tankless_water_heater_repair.pdf
    • https://e40da922-b0e4-44be-9878-2d4898ccab21.filesusr.com/ugd/3a38e0_405cab73d5d6470ca4774e7517529179.pdf?index=true
    • http://warufadul.rf.gd/android_tv_box_x96_mini_s905w.pdf
    • http://jegegapi.rf.gd/friendship_day_status_photos.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010020.bin
13c0e9664f04c716af3c8e4e844e6173bfbd4dcc0f30459387bdc965ce6d3cdf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10020 5644 bytes
font_01_sfnt_off0001135d.bin
dd3a0259737f4e2597a2ce82584988de30b52959211f3bd8055f2c3d0b5630fe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1135D 10600 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.