Malicious PDF — malware analysis report

Static analysis result for SHA-256 7dd53b830824075a…

MALICIOUS

PDF

87.9 KB Created: 2021-02-25 17:53:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: 0c4e819c0ffc1b18c2b91e7cb3bbd57a SHA-1: 57f4265e6e23b0887f2129abc4797deafaca43f6 SHA-256: 7dd53b830824075a13ddbea4908874e9865f46d6ce4bec8217c353af36539de0
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing attempt. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site. The document body, though heavily obfuscated, appears to be a lure related to food calorie information, which is a common tactic for phishing documents.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/123?utm_term=how+many+calories+in+food+list PDF link annotation
    • https://cdn.sqhk.co/lepavenujal/oj59ijz/jackpot_poker_by_pokerstars_free_poker_online.pdfIn PDF document text
    • https://cdn.sqhk.co/tefazaturar/fqcfgco/45442537109.pdfIn PDF document text
    • https://cdn.sqhk.co/wazotifuk/gdgfOje/8081393186.pdfIn PDF document text
    • https://cdn.sqhk.co/fuzekofuwe/GieoVd8/24402807009.pdfIn PDF document text
    • http://aycotoro5.xyz/vadigulunile09l73.pdfIn PDF document text
    • https://cdn.sqhk.co/ponesigis/jbjgiaB/glue_making_business.pdfIn PDF document text
    • https://cdn.sqhk.co/mekoposa/n8hggfL/21770088975.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366313/normal_6031f6b08549f.pdfIn PDF document text
    • http://consequences.space/weed_farming_simulator_19xgy7p.pdfIn PDF document text
    • http://storeeu.info/dubai_visa_application_form_uk5ymfv.pdfIn PDF document text
    • https://cdn.sqhk.co/kulobibab/f5hjAhb/running_shoes_sale_mens.pdfIn PDF document text
    • https://cdn.sqhk.co/nasanoroge/oif5Mgd/std_10_textbook_download.pdfIn PDF document text
    • https://cdn.sqhk.co/leruwexikud/ggjaSt5/willis_ochieng_the_word_master_profile.pdfIn PDF document text
    • https://cdn.sqhk.co/ninubisidire/gjGjcih/guide_for_freedom_genshin.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/vukumesoj/lizotufatupopimege.pdfIn PDF document text
    • https://s3.amazonaws.com/xojafemori/el_capitalismo_libros.pdfIn PDF document text
    • https://s3.amazonaws.com/bokexizometun/michelin_guide_restaurants_bangkok.pdfIn PDF document text
    • https://s3.amazonaws.com/gogunabones/wozovima.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011a0e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11A0E 5324 bytes
SHA-256: daf3923e652be310eae2a690f1ce1ff975d5236bc27e2c2e9426aa92ac52ae02
font_01_sfnt_off00012c24.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12C24 11772 bytes
SHA-256: 0eb242c1bf380c7d2a2e3dc39ce29fb2d66daed6be6710a87df585eed63d66ca

Open this report in the interactive analyzer, or submit your own file for analysis.