Malicious PDF — malware analysis report

Static analysis result for SHA-256 7bc1549a18227b7c…

MALICIOUS

PDF

84.3 KB Created: 2021-05-01 16:51:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1bd97406823ce14adde48a3f11770e7f SHA-1: b06ff1de5c6acda5ce14377b530aa56c69d72044 SHA-256: 7bc1549a18227b7cacd01508a4c0638158ea8155b82fbe906bfddba8f69a6159
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL that masquerades as a link to literature, likely to trick users into visiting a phishing or malware distribution site. No scripts were extracted, but the presence of an external URI and the overall detection suggest a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/strik?utm_term=short+stories+in+english+literature
    • https://cdn-cms.f-static.net/uploads/4464311/normal_5feaf27a331da.pdf
    • https://zedodunojoponex.weebly.com/uploads/1/3/6/0/136083391/kedop.pdf
    • https://cdn.sqhk.co/sifalavuxozo/lTjflij/domibulivowi.pdf
    • https://tuxewuwa.weebly.com/uploads/1/3/4/7/134776055/7162431.pdf
    • http://gubuxuk.scienceontheweb.net/administracion_de_recursos_humanos_snell_bohlander_16_edicion_descargar.pdf
    • https://fupefomaxoxaje.weebly.com/uploads/1/3/4/8/134897629/bbe1ee5414e67.pdf
    • http://rejasikega.scienceontheweb.net/20428636266.pdf
    • http://nezatarofarix.getenjoyment.net/school_objects_vocabulary_exercises.pdf
    • https://cdn-cms.f-static.net/uploads/4467561/normal_6021c20a4f54d.pdf
    • https://numuteje.weebly.com/uploads/1/3/4/6/134683694/sovemibabiwarax_lubiguvixirevag.pdf
    • https://cdn.sqhk.co/vivepovugeli/e7fgd5o/96860332926.pdf
    • https://cdn-cms.f-static.net/uploads/4404523/normal_6042f8c28744c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://0c6b2c5e-c852-454c-8c01-bea24f6181fd.filesusr.com/ugd/b97644_1abf71b2790142d58142a805063b2a3e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/829fc5e6-1181-4b31-acd9-963ce2757f8d/how_long_to_get_a_default_judgement.pdf
    • https://uploads.strikinglycdn.com/files/1b60e126-3944-4e23-8e9b-46a372f37706/how_to_trade_options_work_on_robinhood.pdf
    • https://uploads.strikinglycdn.com/files/9f0f2e45-9142-47f4-8734-a211b9b0691c/www.gohealth.com_admin_america.pdf
    • http://rivenoke.onlinewebshop.net/que_es_el_analisis_del_discurso.pdf
    • http://bufijonewufo.onlinewebshop.net/caderea_constantinopolelui_vintila_corbul.pdf
    • https://c9b0c9dc-51ad-46ec-84b2-dbc26df53712.filesusr.com/ugd/b6f588_9a0ed368f4e34172853a66f91c06f0d6.pdf?index=true
    • https://645c32c3-7e99-4959-b93b-7980205539d7.filesusr.com/ugd/30a31c_3b2dccab95db4c309049365012924a06.pdf?index=true
    • https://uploads.strikinglycdn.com/files/66272981-5f1e-44a6-9831-35ac3c12e991/what_is_horizontal_force_in_physics.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010eb2.bin
555346cc75b994b01ca2dfb2e08607ecf292522421bdd0d5aa14735b8155ee23		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10EB2 5052 bytes
font_01_sfnt_off00011fd3.bin
34c7955fd887d183cbe7d6ed682c959380bf39a823c09da736eba1d324148020		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11FD3 10668 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.