Malicious PDF — malware analysis report

Static analysis result for SHA-256 7f540a574f7be262…

MALICIOUS

PDF

78.9 KB Created: 2021-03-15 09:49:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c10b123d25bb7c20e062c069908d40ed SHA-1: 759e5e97d93a8ccfe02c36506d74b1db641c3cf6 SHA-256: 7f540a574f7be262bde3e0f491852156bc698057ecc5d0392e64f902cacddec3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. The document body, though heavily obfuscated, contains text that appears to be a lure related to 'secret agent spy kid' themes, suggesting a social engineering tactic to entice clicks on the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/strik?utm_term=how+to+be+a+secret+agent+spy+kid
    • http://foxilajat.sportsontheweb.net/sagemisawipukorekatapobe.pdf
    • http://medazuxa.mywebcommunity.org/wiwunepoxujudiwotijo.pdf
    • https://cdn-cms.f-static.net/uploads/4447464/normal_603136cf57aa7.pdf
    • http://xofofumireke.mypressonline.com/nobivisidetekovet.pdf
    • http://pewadulojuba.mypressonline.com/49538447400.pdf
    • http://goligofalu.medianewsonline.com/sat_practice_test_8_2020.pdf
    • http://paxezot.getenjoyment.net/cuisinart_food_processor_dice_vegetables.pdf
    • http://zisuroto.mygamesonline.org/dell_precision_workstation_t3500_service_manual.pdf
    • https://static.s123-cdn-static.com/uploads/4417990/normal_5fec3177787ca.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/a58af045-99ab-4465-84cb-ce964cc63cda/14871695341.pdf
    • https://s3.amazonaws.com/fasudikek/11594205136.pdf
    • https://s3.amazonaws.com/rokuwapesu/oxigenoterapia_hiperbrica_scielo.pdf
    • https://uploads.strikinglycdn.com/files/83371bf3-bc3d-43fb-b9d5-777f5df373e0/what_modem_router_is_compatible_with_spectrum.pdf
    • https://uploads.strikinglycdn.com/files/7d79718f-68c4-4446-8e73-745ef4ac38c8/6837912428.pdf
    • https://uploads.strikinglycdn.com/files/c92b0e4d-9658-4a0d-8c53-38f9f895c730/jutemopanuxoruvoxoveves.pdf
    • https://uploads.strikinglycdn.com/files/f04edcd2-93f1-494a-9afe-201364900239/82571496613.pdf
    • https://uploads.strikinglycdn.com/files/c954dd6e-15fd-4f12-8f64-094a6480fdda/starbucks_cold_brew_cups_bulk.pdf
    • https://s3.amazonaws.com/xijilesuzuxo/tawoloverujetorivudij.pdf
    • https://s3.amazonaws.com/kodipopujufipig/jumijisimosaxomotev.pdf
    • https://uploads.strikinglycdn.com/files/b4004fa9-a72e-4aeb-8d2b-6fbf54015706/samsung_galaxy_s9_latest_price.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3d1.bin
2af55918b16bcbc968891cc4474d97476f7f5b35f3349556950e307dc270da23		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF3D1 5568 bytes
font_01_sfnt_off000106e3.bin
e4cdc33f5fa3f85326c27347a09e2360a679d4651899aaf287b6fbce8c3a077e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x106E3 11688 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.