Malicious PDF — malware analysis report

Static analysis result for SHA-256 77563bef2b5c25e7…

MALICIOUS

PDF

74.9 KB Created: 2021-03-26 15:20:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4cd4e859987b1424fb3b034e14b7876c SHA-1: 532a0ee8909591a421dd9f506233be9c9e834176 SHA-256: 77563bef2b5c25e7d2e6ea81f6d9a9b3c46d85e4a7417342698f9b951679bcce
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document detected as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to a suspicious domain, which is a common tactic for phishing or malware delivery. The document body, though heavily obfuscated, contains fragments that suggest it might be related to financial or medical information, potentially used as a lure. No scripts were extracted, but the presence of an external URI is a strong indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=cortisone+shot+acne+cost+in+india
    • http://saporik.scienceontheweb.net/80337270746.pdf
    • http://boguredu.iblogger.org/pre_algebra_practice_book.pdf
    • http://bupimobim.sportsontheweb.net/concept_of_curriculum_development.pdf
    • http://fejekadiwoxobiz.getenjoyment.net/what_the_meaning_of_admission_rate.pdf
    • http://ravevuzovije.mywebcommunity.org/english_to_cebuano_dictionary_free_download.pdf
    • http://limevekobo.iblogger.org/befikre_movie_video_song_full_hd.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://perexuwofogefo.onlinewebshop.net/portosystemic_shunt_cat_eyes.pdf
    • https://ed36ca5d-e6e9-4caf-8bbb-3a8af5cfee16.filesusr.com/ugd/971556_eed8d734272e4a4ca732b5da81e024d2.pdf?index=true
    • https://4a5bfc55-71df-4474-8f3e-9f6aca65c64b.filesusr.com/ugd/29b6ce_80ec9e98d57049e89661892e175dc306.pdf?index=true
    • https://2225f16e-b6a0-48e2-a067-d7e802b71dd4.filesusr.com/ugd/a7ada4_802ff10ca7be450f8cbbb7e5845df2ac.pdf?index=true
    • https://ded05c8b-f0d8-42bc-a64b-daa0b63394ca.filesusr.com/ugd/99afdc_b4a53ccf35fa4a5292825157af3bc2c0.pdf?index=true
    • http://jodonurinifos.epizy.com/microsoft_pamphlet_template_free.pdf
    • http://sasejas.epizy.com/biochemistry_book.pdf
    • http://butokerisutu.epizy.com/90268205669.pdf
    • http://jumebesatupa.epizy.com/15093367041.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000df67.bin
451391dbe162418d6e3a6cf235ebcb8e5764735ca43dcbf174a5e668860e7161		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDF67 4900 bytes
font_01_sfnt_off0000eff8.bin
dfab3945eace5ba27be1ad95d63d5142397767eab6bca27773794b33bda2302c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFF8 1796 bytes
font_02_sfnt_off0000f882.bin
d55dacc49777a15a29bcd00754d2924d0e7a198bed1887d675e7924319b1a580		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF882 11184 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.