Malicious PDF — malware analysis report

Static analysis result for SHA-256 73f1c5af1388badb…

MALICIOUS

PDF

67.9 KB Created: 2021-04-13 08:57:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1dfcdeb5f598d683775550dbe6ba00ec SHA-1: 2ad5045f2cf0298f1d8b7977362a84da0c819af8 SHA-256: 73f1c5af1388badb48cd0ea003aff5e71cc48908fd4f15dd8d4ca38b06b705cc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing or trojan. It contains an embedded URL that masquerades as nutrition information, likely to trick users into visiting a malicious site. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest a phishing attempt to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=sonic+onion+rings+nutrition+information
    • http://joblanc.xyz/how_to_turn_off_seatbelt_alarm_ford_rangere9u2z.pdf
    • http://kvrovk.xyz/what_is_the_nearest_hardware_storercalx.pdf
    • http://azakalaza3.xyz/62353759209zx0k6.pdf
    • http://b4shop.icu/first_aid_kit_checklistna74g.pdf
    • http://vanesifonemume.22web.org/fevafekemagopavuwifiwavor.pdf
    • http://lifupodez.22web.org/botolok.pdf
    • http://center-about.com/qualities_of_a_good_research_topich1dtd.pdf
    • http://rentline.pro/daughter_of_invention_after_reading_answersak91x.pdf
    • http://matroskin.space/pijokugoworolikuboblxw7.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://gowamatul.epizy.com/61550222338.pdf
    • https://s3.amazonaws.com/mokixetat/57360376722.pdf
    • http://setiwol.epizy.com/newsletter_template_word_format.pdf
    • http://tavuvije.epizy.com/is_my_liftmaster_wifi_enabled.pdf
    • https://b5c90759-dbf8-4ccd-b12d-e23c958527f9.filesusr.com/ugd/915a55_a9fb9be0ad3d477ba42e0e48374268cb.pdf?index=true
    • https://3c3b7999-3797-4e53-a1d2-7989294d2e96.filesusr.com/ugd/cac9e4_5b966f45954e42b2a41841c46d1f7ff6.pdf?index=true
    • http://fepesori.rf.gd/august_month_current_affairs_in_telugu.pdf
    • https://459ec6dd-5b69-4322-a182-74abbfaa0e48.filesusr.com/ugd/221eaa_a514106b2dc446d48c7afbd30767bca9.pdf?index=true
    • http://jilutuve.rf.gd/growstone_crafting_guide.pdf
    • https://s3.amazonaws.com/zodererezuzuxi/kiwipasixiwimaxasubomit.pdf
    • https://s3.amazonaws.com/xovekolamoxe/excel_vlookup_reference_another_sheet.pdf
    • http://topuwagib.epizy.com/saki_saki_song_video_full_hd.pdf
    • https://b81e1767-bb0d-4562-9f98-cfef66859bb1.filesusr.com/ugd/b48b60_1c3510a81bff4223af7b056e99c95990.pdf?index=true
    • https://s3.amazonaws.com/divelatoxa/ar_381-_11.pdf
    • https://s3.amazonaws.com/pibajuwi/handwriting_practice_sheets_for_middle_school.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c9e2.bin
5b5a2c0e690a5910b774280cb5f12b47752bce547e60eab77b6310e37d3d2a66		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC9E2 5272 bytes
font_01_sfnt_off0000dbbd.bin
53346941c03b74f04bd264625346bb466b69dcd638bf1ad1165fce4b4724bfde		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDBBD 11012 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.