Malicious PDF — malware analysis report

Static analysis result for SHA-256 70085c1a6a8316e5…

MALICIOUS

PDF

86.1 KB Created: 2021-06-29 08:17:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: a57887ab52c90e4e0548e95134a2d815 SHA-1: 72831c2d60e16542ba7c3694ba3a35f6da83a48b SHA-256: 70085c1a6a8316e5cc4123905d2243aada9eb3ab26eb0c1b0589f9968c5376a0
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The sample was identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains multiple embedded URLs pointing to PDF files, suggesting it's part of a phishing campaign designed to deliver malware. The document body is heavily obfuscated and unreadable, but the presence of external URIs and the overall detection indicate a malicious intent to trick users into downloading and executing further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://camile.vn/wp-content/plugins/super-forms/uploads/php/files/9b6aloiioid4v6v1s1kblb2g60/33125538772.pdf
    • http://chinoboxingclub.com/clients/36032/File/98858323056.pdf
    • https://plumcourse.com/wp-content/plugins/super-forms/uploads/php/files/31c31ae8371dca675d0429dd1dacf323/2216336121.pdf
    • http://joshuadacosta.com/wp-content/plugins/formcraft/file-upload/server/content/files/160cb75303f8c1---bufifejimelotogifuletipa.pdf
    • https://www.couleurs-et-jardin.fr/wp-content/plugins/formcraft/file-upload/server/content/files/160714b8eb759b---zipiretunakakagajal.pdf
    • http://themultifold.com/wp-content/plugins/super-forms/uploads/php/files/mf5032u7u5i200uk823j4b2d67/59985926440.pdf
    • http://cathugo.de/res/wysiwyg/file/61689624280.pdf
    • http://foire-fromages-et-vins.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bebfd63c3bd---89491035900.pdf
    • https://carthink.org/wp-content/plugins/formcraft/file-upload/server/content/files/1606c8e31e15a3---gutotifupinogi.pdf
    • https://carparts-fixture.com/file/file/jefifumimuzowitonusa.pdf
    • https://www.generalutilities.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b72c4887182---76619615869.pdf
    • http://veronicanealhome.com/wp-content/plugins/formcraft/file-upload/server/content/files/2/16072a259a4f28---4668443929.pdf
    • https://bdsvieclam.com/upload/files/dozisizit.pdf
    • http://www.cargeacrew.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16084df05bd9f6---guxewigubo.pdf
    • http://opalbiosciences.com/wp-content/plugins/formcraft/file-upload/server/content/files/160afb2d1dc7b2---metubigewolupulad.pdf
    • http://coinmarketsuite.com/ckfinder/userfiles/files/45756583768.pdf
    • http://csc0512.com/userfiles/file/20210611154640_hkg15g.pdf
    • http://www.infranetltd.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606cfb172a377---fobufigelumetogepa.pdf
    • http://shethof.ch/cgi-bin/dynamisch/file/kizoni.pdf
    • https://chefinhogourmet.com/wp-content/plugins/super-forms/uploads/php/files/76f450aa115d021c261b32938972da9c/39863838090.pdf
    • http://braintradingbcn.com/wp-content/plugins/super-forms/uploads/php/files/9ac110d3e4ff4af515f3e0e73e0de58b/ganukolotakan.pdf
    • https://joepromenshealth.com/wp-content/plugins/super-forms/uploads/php/files/14a91f99f1d2f12abcf8076aba36dfa5/regafi.pdf
    • http://nexxosrealty.com/userfiles/files/41558864163.pdf
    • https://humantouchtranslations.com/wp-content/plugins/formcraft/file-upload/server/content/files/1/1607756abc9a0a---busilesoxitetusadu.pdf
    • https://jclifeschools.org/wp-content/plugins/super-forms/uploads/php/files/0c9b7c647523495e79ebcbf95bb7c50f/79042788401.pdf
    • https://feedproxy.google.com/~r/Uplcv/~3/3CAf4wW3hvY/uplcv?utm_term=physics+giancoli+6th+edition+solutions+manual+pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e946.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE946 16792 bytes
font_01_sfnt_off00010158.bin
64abf7726bfbdba95a2223ad56e33868cadc8e310a4771f7d49766002a1de99a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10158 18068 bytes
font_02_sfnt_off00013074.bin
3840c7e24598d6909a651482f8dbf601fee7309a6615824715cf1042d19f6e62		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13074 11348 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.