Malicious PDF — malware analysis report

Static analysis result for SHA-256 7303eb5f01d9f70b…

MALICIOUS

PDF

86.4 KB Created: 2021-07-04 08:06:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 1f3f8f409a675d007446816a729d93ab SHA-1: 559bc0623561650bad3986c65a97fa0fe002fa84 SHA-256: 7303eb5f01d9f70b696778b9bf35b19cddd0f9a6922f8d6c217012f7712d55fb
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The PDF contains numerous embedded URLs, many of which point to suspicious domains and appear to be designed to trick users into downloading further malicious content. While no scripts were explicitly extracted, the PDF structure and embedded URIs suggest it's designed to redirect users to potentially malicious sites, aligning with phishing or malware distribution tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://oneself.pro/wp-content/plugins/formcraft/file-upload/server/content/files/160a643de1ba3d---pukibokek.pdf
    • https://postelezmasivu-zlin.cz/ckfinder/userfiles/files/nuzebisotevivupefawife.pdf
    • http://www.fullmooneye.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a45d03b5200---51755873239.pdf
    • https://gmonlinestore.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f2a63b9888---69204422327.pdf
    • http://mko-yug.ru/wp-content/plugins/super-forms/uploads/php/files/e1d79e2b44422ea7662916c13d2275d9/delijavagepisagopiwobokox.pdf
    • https://pousadamarazul.tur.br/wp-content/plugins/formcraft/file-upload/server/content/files/16092a49ecf389---80053091130.pdf
    • http://willbramephotography.com/badomajuzuxep.pdf
    • https://www.oasipizza.it/wp-content/plugins/formcraft/file-upload/server/content/files/160ab169311c1b---62098624000.pdf
    • https://bandotrading.it/uploads/file/zifefumamikazederavifi.pdf
    • https://detectiveoffice.net/userfiles/file/28842411348.pdf
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608923a95df2c---74968709910.pdf
    • https://www.bountyvacation.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c135afcf2d8---sovogubalunesaborezatuv.pdf
    • http://globaltruthmediagroup.com/clients/a/aa/aa8380eac451876ae6ab993bf3a720d6/File/29380745370.pdf
    • https://kede.org/userfiles/file/13654458471.pdf
    • http://melissajacksonmd.com/wp-content/plugins/formcraft/file-upload/server/content/files/16080040eec111---69666465803.pdf
    • http://www.photobreak.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160b77b97bffd1---21516605454.pdf
    • http://maxgear.cz/webpagebuilder/ckfinder/userfiles/files/31474327332.pdf
    • https://cutletsmeat.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609e5eef6cb39---79282893103.pdf
    • http://novaserv.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d5cae9ab80---96644057404.pdf
    • https://marciasmithconsulting.com/wp-content/plugins/super-forms/uploads/php/files/78e26a26e50f27c80aff8698857d8f4b/48948470734.pdf
    • https://www.baileysmilk.com/wp-content/plugins/super-forms/uploads/php/files/4e6935bfad2121d8702d5aa2bf3e1b2c/lamufozo.pdf
    • http://camonetinternational.com/files/file/95343383043.pdf
    • http://udokutscher.de/gfx/userfiles/files/tosuverolujofexavefenaza.pdf
    • https://webtraffic.ch/wp-content/plugins/super-forms/uploads/php/files/v7he6q08q933ts1gm5acflp7ej/27063233846.pdf
    • https://humicdp.com/uploads/2021-06-19/images/files/juseluselulalanev.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/S30rS-6n6vg/uplcv?utm_term=chinese+yuan+in+usd
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec95.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC95 16792 bytes
font_01_sfnt_off000104ac.bin
b00689cb77983fa137d09f85f61d0cb9ae883e2743571fc397fadeabf17452f2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104AC 10228 bytes
font_02_sfnt_off00011b94.bin
a915060ad1a47d5f35a2ff72c14ceed79da3b391186d3b84c0c9484a2de926b0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11B94 18168 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.