Malicious PDF — malware analysis report

Static analysis result for SHA-256 7bd7d6c09d9831a3…

MALICIOUS

PDF

72.5 KB Created: 2021-04-06 23:53:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 12898f940ef7a1f870914a8c6e2399e9 SHA-1: a52536aac1bf476d8928472bcec8f9ac00f73e9c SHA-256: 7bd7d6c09d9831a3103505fc8ddfea880f15ee60d1c525e68f29bdde688bb21c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a suspicious domain, likely intended for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, suggests a lure related to a product manual, which is a common tactic for social engineering.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/wix?keyword=singer+5050c+manual+en+espa%25C3%25B1ol
    • https://cdn.sqhk.co/biposuba/1ggjdhb/venter_sputnik_trailer_for_sale.pdf
    • http://albl.ru/the_happytime_murders_torrent_downlo9frt9.pdf
    • https://cdn-cms.f-static.net/uploads/4371023/normal_5fe80575e3d50.pdf
    • https://cdn.sqhk.co/dixejetafap/aVifXhd/88784042024.pdf
    • http://good-production16.site/letimivofoq0ubs.pdf
    • https://cdn-cms.f-static.net/uploads/4483361/normal_5fd1c46b5fe30.pdf
    • http://nncucuucuc.space/9077324012058rcw.pdf
    • https://static.s123-cdn-static.com/uploads/4458628/normal_5ffb2b008654e.pdf
    • https://static.s123-cdn-static.com/uploads/4443824/normal_5fdf0e70debf8.pdf
    • http://itdiscount.info/how_to_light_a_dyna_glo_kerosene_heater_manual2qefw.pdf
    • https://cdn-cms.f-static.net/uploads/4366654/normal_602f61b32a0eb.pdf
    • http://peuly.xyz/wewagefisoverivovametifinv0l5.pdf
    • https://static.s123-cdn-static.com/uploads/4365551/normal_5ff66fb4affea.pdf
    • http://wei-nmvc.com/how_much_is_a_first_edition_harry_potter_and_the_order_of_the_phoenix_worthv9feu.pdf
    • https://cdn-cms.f-static.net/uploads/4460060/normal_602e21db2eaa7.pdf
    • http://libralab.digital/gidoronilitokifisgw78m.pdf
    • https://cdn-cms.f-static.net/uploads/4420924/normal_603ccd2777937.pdf
    • http://reactivascotia2020.com/comentario_biblico_mundo_hispano_tomo_9_gratiswg9li.pdf
    • https://cdn.sqhk.co/navimoxa/bEc8cii/92738183429.pdf
    • http://ecosbor.net/what_are_the_3_things_the_declaration_of_independence_doesy2sd3.pdf
    • https://cdn.sqhk.co/bivuwusim/djjLXYr/5154039701.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://6acf0ca1-aa41-4771-8b91-54baff69ee7f.filesusr.com/ugd/7d1dc9_6316e29d14894f8e9594f0c9e9843010.pdf?index=true
    • https://b40f07b9-a98f-42b6-a6e2-5dc2c82ebb0e.filesusr.com/ugd/e949ea_5baa54f87f1d48d29805de1792c7dfea.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d935.bin
c62d776d8a4f9de6d7443efbeee28fe6ace238bb86e904290c45099f3f071473		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD935 5832 bytes
font_01_sfnt_off0000ecbc.bin
4e2e9cd19a5ddd9b31cf71e6e7d1b23991eb6564250cbf8cce7bcb87938ccedb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECBC 11216 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.