Malicious PDF — malware analysis report

Static analysis result for SHA-256 752d2cf6857e77ef…

MALICIOUS

PDF

73.5 KB Created: 2021-05-01 08:41:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d6207e5b5b2bd763f60066ab1f878247 SHA-1: 33e7ec08d7e5bb07abf955e561e984b380a92658 SHA-256: 752d2cf6857e77efe1532f9b43d73085d7a09e22cb4c1c638b5772f18f8f2161
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF was flagged by a machine learning classifier and ClamAV as malicious, indicating a phishing or trojan distribution attempt. The embedded URI points to a URL that, while marked benign, is part of a pattern of suspicious links found within the document. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the presence of multiple suspicious URLs suggests a phishing or malware delivery scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://greshamgilessalon.com/wp-content/plugins/super-forms/uploads/php/files/ef34caa79a6c2920328271dfe0852440/99108352.pdf
    • http://www.onegelha.com/wp-content/plugins/super-forms/uploads/php/files/92a782d92508f5c1118151904d85ca67/78708206464.pdf
    • http://plenar.hr/wp-content/plugins/formcraft/file-upload/server/content/files/160818580b3054---faduw.pdf
    • http://www.hkwebdesign.com.hk/wp-content/plugins/formcraft/file-upload/server/content/files/16073e6a91b48e---68799246119.pdf
    • https://callhfelectric.com/wp-content/plugins/formcraft/file-upload/server/content/files/16085d838d7455---22078420567.pdf
    • https://www.oneirishrover.com/wp-content/plugins/super-forms/uploads/php/files/32e7762d7d0798bbc4e3b22745d80ba5/67015298110.pdf
    • http://vdgairconditioning.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1607ee3951d370---natugafozazolojesopafise.pdf
    • https://psychotherapie-dr-albrecht.de/wp-content/plugins/formcraft/file-upload/server/content/files/160705bb572288---kaxitive.pdf
    • https://www.conkite.com/wp-content/plugins/super-forms/uploads/php/files/363574f6302e552b7154c46107ab1210/30752504222.pdf
    • http://kaplanpm.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607e20a0c05c1---lipaxezewapewazeleraz.pdf
    • http://www.hj-bouwt.be/wp-content/plugins/formcraft/file-upload/server/content/files/16084e350de581---piwugubijenadilazalenap.pdf
    • https://hmjrgoldhockey.org/wp-content/plugins/super-forms/uploads/php/files/53ffe6a256987d311d81ddb8457473e8/nekikodipipowakifigujufe.pdf
    • http://principessavencanice.com/wp-content/plugins/formcraft/file-upload/server/content/files/16078e905da430---201641713.pdf
    • http://iamsoldierfit.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f7af1f0b36---66733238633.pdf
    • https://broadstripe.com/wp-content/plugins/super-forms/uploads/php/files/2c4d23422af75189418aa0b781178fd1/wumujozapojogixonuwefule.pdf
    • http://apluskleaning.com/admin/images/file/katimulojuvirafizilaf.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/skout/mBVl/~3/zMnd8XtcwSM/uplcv?utm_term=android+developer+settings
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e4f3.bin
52b7bb53a5b8512ef926ce02c08f1ae50e730f521a10c8974ef3a8e8af219822		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE4F3 4964 bytes
font_01_sfnt_off0000f5f1.bin
b13ec93b3456195e8849385b6c10d69ca1a0b81120128117d27e71a70337a733		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF5F1 10456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.