Malicious PDF — malware analysis report

Static analysis result for SHA-256 7bca3c347896e701…

MALICIOUS

PDF

79.3 KB Created: 2021-01-23 04:39:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 2e12334f7cf0e201fc56c9147e897860 SHA-1: 7bb9a81151955686ace486caf615345a36805a7b SHA-256: 7bca3c347896e701af74c461725fb6798d691568a0ee13835303406c86c93ee5
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ML classifiers and ClamAV. It contains an embedded URI pointing to a suspicious domain, which is likely intended to host a malicious payload or phishing content. The document body, though heavily obfuscated, appears to reference technical terms, suggesting a lure for users interested in such topics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/123?utm_term=effective+mass+calculation+quantum+espresso PDF link annotation
    • https://site-1174259.mozfiles.com/files/1174259/88619768353.pdfIn PDF document text
    • https://site-1166659.mozfiles.com/files/1166659/64194630612.pdfIn PDF document text
    • https://site-1179234.mozfiles.com/files/1179234/django_template_and_dictionary.pdfIn PDF document text
    • https://site-1166704.mozfiles.com/files/1166704/idea_mobile_recharge_offers_online.pdfIn PDF document text
    • https://site-1083679.mozfiles.com/files/1083679/20198779791.pdfIn PDF document text
    • http://kexejadupuna.66ghz.com/34308438621.pdfIn PDF document text
    • https://site-1171714.mozfiles.com/files/1171714/lisagaxawedazutuniw.pdfIn PDF document text
    • https://site-1175125.mozfiles.com/files/1175125/netflix_vr_download_pc.pdfIn PDF document text
    • https://site-1177387.mozfiles.com/files/1177387/57558958325.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/zategafozasiru/13214865666.pdfIn PDF document text
    • https://s3.amazonaws.com/sikuva/86693700220.pdfIn PDF document text
    • https://s3.amazonaws.com/bisiku/2065474908.pdfIn PDF document text
    • https://s3.amazonaws.com/xurixado/pozujik.pdfIn PDF document text
    • http://romipozaxijida.rf.gd/vasekonenedurekum.pdfIn PDF document text
    • https://s3.amazonaws.com/juzewojavomofew/armageddon_movie_in_tamil_dubbed.pdfIn PDF document text
    • https://s3.amazonaws.com/suzujewa/tunefoxazubufimaje.pdfIn PDF document text
    • http://nuxavezuzoja.epizy.com/baseball_t_shirt_template_illustrator.pdfIn PDF document text
    • https://s3.amazonaws.com/tawovojo/best_belly_dance_songs.pdfIn PDF document text
    • https://s3.amazonaws.com/wujapu/chrome_addons_for_android.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eacb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEACB 5184 bytes
SHA-256: 6004e07ea5495457494221272f001856e1c0c2b1592d46276903bd76b0669f8b
font_01_sfnt_off0000fc5e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC5E 10984 bytes
SHA-256: 5fd43af81857958b0614a7209fd748e014eb24022b60d8806507072bb64fb5ef
font_02_sfnt_off000121e9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x121E9 4324 bytes
SHA-256: 05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176

Open this report in the interactive analyzer, or submit your own file for analysis.