Malicious PDF — malware analysis report

Static analysis result for SHA-256 72c670f99737f73e…

MALICIOUS

PDF

77.9 KB Created: 2021-03-05 15:24:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-07
MD5: e8af4ef76cddcc6b9c88bbdabd2a3e53 SHA-1: 79cf8070b446ddfdbf9298184ccad0bc71ff3da5 SHA-256: 72c670f99737f73eb0043d3b2bdfe64fefa67e310912ad2b101b489029a79cbd
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. The embedded URL points to a suspicious domain, likely intended to host malicious content or redirect the user. The document body, though heavily obfuscated, contains a title that could be used as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=positive+effects+of+the+cold+war PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4450257/normal_5fd9f40ea090a.pdfIn PDF document text
    • http://gewututikame.getenjoyment.net/how_much_does_it_cost_to_get_a_cdl_license_in_arkansas.pdfIn PDF document text
    • http://tokivaburag.22web.org/bioetica_definicion.pdfIn PDF document text
    • http://fupefabesosada.mygamesonline.org/53842162046.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4495039/normal_6041c5118ca34.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373511/normal_602e28b43f8dd.pdfIn PDF document text
    • http://paxezot.getenjoyment.net/jijutonaligud.pdfIn PDF document text
    • http://pelinebaj.mypressonline.com/five_nights_at_freddys_game_player.pdfIn PDF document text
    • http://pinegobojefo.getenjoyment.net/gesufovaxibulixavunuvasi.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://ketoxuxun.epizy.com/far_westerns_swimming_2019_psych_sheet.pdfIn PDF document text
    • https://s3.amazonaws.com/wewuxuviwar/ponemon_cyber_security_report_2018.pdfIn PDF document text
    • https://s3.amazonaws.com/buganabowumujef/zapagotefejo.pdfIn PDF document text
    • http://lerezivopo.rf.gd/media_clip_pro_video_er.pdfIn PDF document text
    • http://sazasewugekupej.onlinewebshop.net/1186056605.pdfIn PDF document text
    • http://wugorasu.rf.gd/gizoliwoli.pdfIn PDF document text
    • https://s3.amazonaws.com/viboxikuz/calendario_escolar_galicia_2019.pdfIn PDF document text
    • http://lanikudawojag.rf.gd/aanandam_movie_naa_songs.pdfIn PDF document text
    • https://s3.amazonaws.com/tipikaxe/78968939688.pdfIn PDF document text
    • http://vimixof.onlinewebshop.net/principles_of_design_balance_dress.pdfIn PDF document text
    • https://s3.amazonaws.com/pujirageg/93834092666.pdfIn PDF document text
    • https://s3.amazonaws.com/naxozelozude/tencent_gaming_buddy_latest_version.pdfIn PDF document text
    • http://inigoortizdeguzman.files.wordpress.com/2010/11/corea-portada.jpg?w=570In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4eb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF4EB 5264 bytes
SHA-256: 827a9a8c53d541c020fa92407af6bbc4236ee6861c5d1c5d6eb7f4f798c007b6
font_01_sfnt_off000106e6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x106E6 10424 bytes
SHA-256: f62c4a5c264133b2d7e5efddab3707a4553f8f05a6ed179be4013ade3c3dcf1e

Open this report in the interactive analyzer, or submit your own file for analysis.