Malicious PDF — malware analysis report

Static analysis result for SHA-256 6fc3af34d99d3f30…

MALICIOUS

PDF

122.0 KB Created: 2021-03-18 13:55:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-20
MD5: 058b7deab65431c62e87af1a6744d721 SHA-1: a66903f1f6777ea816588e0215c50d73384f9f87 SHA-256: 6fc3af34d99d3f300e81d2290f891c66e6dc3e756b42109142698298bb9bbcbc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely intended to redirect the user to a malicious site. While no scripts were explicitly extracted, the presence of embedded URLs and the nature of the ClamAV detection suggest a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/wix?keyword=taylor+merchant+560 PDF link annotation
    • http://trafikcezaodebayisi.com/xutiwuvuryzchv.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471723/normal_603ddf8b2f581.pdfIn PDF document text
    • http://texno3ua.com/42891689412e2whg.pdfIn PDF document text
    • http://snail-case.store/mental_toughness_in_sportvsu62.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4488137/normal_5fd62b1808905.pdfIn PDF document text
    • http://reweder.site/what_is_a_rational_and_an_irrational_numbertclgm.pdfIn PDF document text
    • http://topdiscount.pro/does_sonic_have_half_price_shakes_after_8_p.mdehfb.pdfIn PDF document text
    • http://mobile-media.moscow/how_to_wind_a_bobbin_on_a_singer_simplebrtal.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4479224/normal_604c9671de1e0.pdfIn PDF document text
    • http://connexion-amelii.xyz/86145806877lnxkq.pdfIn PDF document text
    • http://dogalijun.scienceontheweb.net/mechanical_engineering_internships_washington_state.pdfIn PDF document text
    • http://metryck.info/mumuvunum4pevl.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/turip/54936537635.pdfIn PDF document text
    • http://nujugeteteda.myartsonline.com/gemekivijamikidapif.pdfIn PDF document text
    • https://s3.amazonaws.com/gimufesajo/13320634853.pdfIn PDF document text
    • https://s3.amazonaws.com/varolexexus/mumoduwufakunofete.pdfIn PDF document text
    • https://s3.amazonaws.com/tevomenil/the_reasonableness_of_christianity_john_locke.pdfIn PDF document text
    • https://s3.amazonaws.com/rutufokedizon/tabotebijasiwodon.pdfIn PDF document text
    • https://s3.amazonaws.com/pokorevalaxex/potuwoxijejajelaratu.pdfIn PDF document text
    • https://s3.amazonaws.com/tazopaju/93913802448.pdfIn PDF document text
    • https://s3.amazonaws.com/zodawanuror/sejanewegudulipadezinugav.pdfIn PDF document text
    • https://s3.amazonaws.com/vososasoxumete/great_gatsby_chapter_7.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001a16a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A16A 5332 bytes
SHA-256: 39ac5b97711c6e82663bbf6c96de87413d8c2f9f42546e2fff7f2c770fd1991c
font_01_sfnt_off0001b36b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B36B 11504 bytes
SHA-256: 3c3682f82713d1955f01f464250a16ef19e5c00d8b2cd81631e92054c498de34

Open this report in the interactive analyzer, or submit your own file for analysis.