Malicious PDF — malware analysis report

Static analysis result for SHA-256 7031c9b656a3c356…

MALICIOUS

PDF

77.4 KB Created: 2021-03-25 08:13:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 99353c5b4f4ae11f633857d468ae90b5 SHA-1: 5583c626c874ff959b4d57a6f482f0affec1d74c SHA-256: 7031c9b656a3c356d57d6d4ee48afc9c139af1523c831a47ab4ea7930a7078be
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site for further exploitation. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the presence of the external URI strongly suggests a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=high+plains+emmaus
    • https://static.s123-cdn-static.com/uploads/4393353/normal_5ff01ee9476d9.pdf
    • https://cdn.sqhk.co/denobafopum/atjetOq/ball_blast_level_200.pdf
    • http://votixowet.22web.org/fleece_bed_sheets_primark.pdf
    • https://cdn-cms.f-static.net/uploads/4496828/normal_5fe6c9598eff2.pdf
    • https://cdn-cms.f-static.net/uploads/4445866/normal_5fda2f491597c.pdf
    • https://cdn-cms.f-static.net/uploads/4444369/normal_60197457cbcdc.pdf
    • https://cdn.sqhk.co/wemopizajazo/fidqgdM/ultimate_epic_battle_simulator_unblocked.pdf
    • http://fakabegapufiri.22web.org/advanced_excel_2020.pdf
    • https://cdn-cms.f-static.net/uploads/4422620/normal_5fd780b36799d.pdf
    • https://cdn.sqhk.co/zejizoguzut/ajbifib/fikipirepebamu.pdf
    • http://www.highpla
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/2069f788-10cb-45b0-866d-d0a2ad50fe3b/dajufawogarewerop.pdf
    • https://s3.amazonaws.com/fodose/webijeluko.pdf
    • https://f770b3d7-c897-40e0-9323-5ad0abd91552.filesusr.com/ugd/1fa6dd_faebb4b798a742e096b98fb2e675c1ad.pdf?index=true
    • https://uploads.strikinglycdn.com/files/4615163a-d139-43e7-b87b-18462247c031/suxitilizomujos.pdf
    • https://uploads.strikinglycdn.com/files/476d4792-4550-4e17-b28d-e26fc9913d38/fringe_tv_series_season_1_free_download.pdf
    • https://eb62986f-0112-409a-9ebe-777412bc5c19.filesusr.com/ugd/26938b_2f79a5c566314c5b92fb8f6a38f8fae2.pdf?index=true
    • https://s3.amazonaws.com/fedure/bubble_games_app.pdf
    • https://f516a5e5-1936-4b34-b436-a929b3a34b8d.filesusr.com/ugd/774001_8bf99783c8d94dffa388e272ce0144a4.pdf?index=true
    • https://uploads.strikinglycdn.com/files/57e5abce-b617-4f9d-976c-31c16110a38f/arris_tg862_modem_factory_reset.pdf
    • https://uploads.strikinglycdn.com/files/fd4cde25-a49e-4d45-9f84-c64cbea5117e/heroes_of_the_horrors_book.pdf
    • https://95e354e6-8561-4e52-807b-deb85f3b5fdd.filesusr.com/ugd/ca9b0a_32945a3230aa43d38e7ebac6fba78a25.pdf?index=true
    • https://8d6920c1-aef5-45ed-b1a0-e693d63948fb.filesusr.com/ugd/0a593f_f51acfec56754c1a99c3b0f9bf3efc20.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000efc6.bin
bebf37e94765e897162b760b5a58fa30e1ae65bdb5d80371839540feef2c4c5f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFC6 5096 bytes
font_01_sfnt_off000100fd.bin
43b48e1aa01b8331812e49c7cbe3e073d7a70a7502bd90496511a3439c9cb6c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100FD 11704 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.