Malicious PDF — malware analysis report

Static analysis result for SHA-256 70a89858d815e9db…

MALICIOUS

PDF

78.8 KB Created: 2021-05-28 00:47:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 92b690a89e621f392e8aa9dace2c240b SHA-1: d2e40eafc5c3a555bf5013391f1393a3691cd485 SHA-256: 70a89858d815e9db417245ab402f49e9909c3c32d1089980d2cf15682b2b2843
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. ClamAV detection and ML classification strongly indicate malicious intent. The file's metadata suggests it was generated by wkhtmltopdf, a tool sometimes used to create malicious PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/123?utm_term=periodic+table+notes+pdf
    • https://cdn-cms.f-static.net/uploads/4382948/normal_6025f0bee3970.pdf
    • https://static.s123-cdn-static.com/uploads/4417827/normal_5ff8b86073194.pdf
    • https://static.s123-cdn-static.com/uploads/4425727/normal_5ffff0c053ce3.pdf
    • https://cdn-cms.f-static.net/uploads/4383680/normal_606d8db875e7c.pdf
    • https://cdn-cms.f-static.net/uploads/4366362/normal_604122b9d8d36.pdf
    • https://cdn-cms.f-static.net/uploads/4496584/normal_6028edc29e476.pdf
    • https://static.s123-cdn-static.com/uploads/4371787/normal_600309baf39f1.pdf
    • https://static.s123-cdn-static.com/uploads/4417137/normal_5ff129950847b.pdf
    • https://static.s123-cdn-static.com/uploads/4467318/normal_5ffac08fd1e6c.pdf
    • https://static.s123-cdn-static.com/uploads/4454170/normal_5fe2cac30c86e.pdf
    • https://cdn-cms.f-static.net/uploads/4383703/normal_600ef7132435f.pdf
    • https://static.s123-cdn-static.com/uploads/4417995/normal_5fe27ae932b48.pdf
    • https://static.s123-cdn-static.com/uploads/4477401/normal_5fe380e002f2a.pdf
    • https://cdn-cms.f-static.net/uploads/4445880/normal_6021bdc574e01.pdf
    • https://static.s123-cdn-static.com/uploads/4372737/normal_5fca341b6806f.pdf
    • https://static.s123-cdn-static.com/uploads/4470224/normal_5fed3fb2ee895.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/a2c50154-9935-4e24-bca1-5f917b188ffd/webonezawu.pdf
    • https://uploads.strikinglycdn.com/files/5e8925bf-0dd1-4ed4-9aba-9be11a80d739/wovifogojorewosugo.pdf
    • https://uploads.strikinglycdn.com/files/189db437-fa83-4ebc-9385-87a9ee09df9f/fantastic_mr_fox_soundtrack_youtube.pdf
    • https://uploads.strikinglycdn.com/files/061b7b0d-fee2-4513-8ffb-ff71be17e19a/how_to_do_waiter_service.pdf
    • https://uploads.strikinglycdn.com/files/c78e5593-1f30-4471-897a-725606269314/creative_sound_blaster_x-fi_surround_5.1_driver_windows_8.pdf
    • https://uploads.strikinglycdn.com/files/5317b063-2712-4e3d-b171-6732ca30a3bd/12101860273.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e8c7.bin
bf8e96b80179c0f3fac6a8a327d29059304506b6ba6e448bc45cfb0ef25b33c0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE8C7 5076 bytes
font_01_sfnt_off0000fa00.bin
ebc45633831406babccaef9972c09ea26830ab278267f95d53299136901c4682		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA00 10632 bytes
font_02_sfnt_off00011e30.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11E30 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.