Malicious PDF — malware analysis report

Static analysis result for SHA-256 74fcdb18bbef4683…

MALICIOUS

PDF

91.4 KB Created: 2021-02-14 21:26:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: af0ac704ecab9d70665e7e9d98d9804e SHA-1: decb24047e61a54b3fdb0a5de49b213321e3d8cc SHA-256: 74fcdb18bbef46834b6754bc4c7e211c8926bd94cd78a2ae7f0603f6f2ae62ea
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that redirects to a suspicious domain, masquerading as information about puppies. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware distribution. No scripts were extracted, but the presence of an external URI suggests an attempt to lead the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wix?keyword=beagle+husky+mix+puppies
    • https://cdn.sqhk.co/sanevujaguda/v2rvmhh/indycar_iracing_challenge.pdf
    • http://naturaleone.space/37968467032y59wu.pdf
    • http://smartcreditus.info/377720381641cs9u.pdf
    • https://fitisasituwag.weebly.com/uploads/1/3/4/8/134846324/xasoxemitog-mozojiloxugaru-vigijikonepeb.pdf
    • http://tublitalia.space/48_laws_of_power_quotesmyp40.pdf
    • https://geguxawuxereko.weebly.com/uploads/1/3/1/3/131379712/9879445.pdf
    • http://superheatbelt.xyz/ascii_art_maker_apknvut9.pdf
    • https://cdn.sqhk.co/winelolibug/iiiegdP/experimental_aircraft_for_sale_california.pdf
    • https://tebafazar.weebly.com/uploads/1/3/4/2/134265880/betolufovowakab.pdf
    • http://fokikizuxijem.iblogger.org/dufakope.pdf
    • http://simultaneously.space/zupumunafiwye5r.pdf
    • http://mishabelle.ru/391040760548n7be.pdf
    • http://bluebadge-support.com/bootstrap_4_contact_form_textareae5big.pdf
    • https://cdn.sqhk.co/zibusisujij/ZlGwigM/birds_of_prey_2020_streaming.pdf
    • https://femesavez.weebly.com/uploads/1/3/1/3/131383434/donenokus.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/vososasoxumete/nys_pistol_permit_renewal_form.pdf
    • https://s3.amazonaws.com/gizonukorad/antivirus_x_tablet_android_gratis.pdf
    • https://s3.amazonaws.com/paxivogedewilu/engineering_guide_1-_300_classic_wow.pdf
    • https://s3.amazonaws.com/kulinisokakewi/lewis_acids_and_bases.pdf
    • http://junusesofuxog.rf.gd/compustar_dc3_install_guide.pdf
    • http://japixunatavaxi.rf.gd/82988476520.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f933.bin
cdcc26757d1fbfa121d1f8b44b9da860994a6e12077057686b792b7fbb7db68f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF933 5420 bytes
font_01_sfnt_off00010b87.bin
809475ed0ff5ffdf3b873a968a64602aaa24e0c116d1aa2c473c9628891732df		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B87 8156 bytes
font_02_sfnt_off0001263b.bin
532a5c07f4eeb816f13f473316a1ede3b7f448b5af81adfc91a6d17c7378f472		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1263B 10240 bytes
font_03_sfnt_off00014964.bin
20cde93dd26cc844a52735c985ca13aa4b3b3897aa87c998df43ca580712f53d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14964 16512 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.