Malicious PDF — malware analysis report

Static analysis result for SHA-256 7f6a8d58dc260fca…

MALICIOUS

PDF

82.7 KB Created: 2021-03-24 14:22:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: 2d6a56b73949fb96e3abecf0de1f63e6 SHA-1: f525965a31267c3a5ff54ea149b09a1f90b26681 SHA-256: 7f6a8d58dc260fcade8a44ab4020c485798dac083ecce98089f755bc14d777ec
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, which is likely intended to trick the user into visiting a phishing or malware distribution site. ClamAV and ML classifiers also flagged this PDF as malicious, indicating a high likelihood of malicious intent. The document body, though heavily obfuscated, appears to contain text related to a PDF archive, reinforcing the phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=macleod+s+clinical+examination+pdf+archive PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4450247/normal_603d6e42f2bcd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481055/normal_60525f5faaaa1.pdfIn PDF document text
    • http://taher-tcac.com/96802803142wusf3.pdfIn PDF document text
    • http://uablog.site/free_wifi_app_downloadj7lmt.pdfIn PDF document text
    • http://modernstyle.pro/bbuddah_hoga_terra_baap_movie_hddoyzh.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366063/normal_604e860e687d4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4493610/normal_5ff7a6d56d0d7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387040/normal_60565a7ca2212.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4411228/normal_60199205e71e0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4402507/normal_5fd16d49f2c58.pdfIn PDF document text
    • http://lovechat24.club/nokalif4nnt.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4483070/normal_5fe2b177ee706.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/f1b9cfec-dbce-47ac-a757-58fd31d1adf6/hamlet_act_4_scene_2.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bf964d82-a396-400e-aac3-068391072eef/difference_between_adobe_premiere_pro_2018_and_2019.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0ebdfa80-d879-4ffa-bcba-6d2449217132/abiyoyo_returns.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/820b66b3-a33a-44b9-9766-2090b4726920/lg_dishwasher_3850dd3006e_door_spring.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/48f2eb60-a9ed-4417-b60e-b7f4e9faa100/88304869050.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c4caa43d-38cf-4690-8690-0b58f7702231/fakuteletinosaxuju.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/13b32c69-fe43-4a47-8c1a-eddca5f96283/69109579098.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb8f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB8F 5316 bytes
SHA-256: 0deb26453b165b169d6a87bdb1733dc7c5ba2df85c8b97449cad2a4ec0cd70f5
font_01_sfnt_off0000fd6c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD6C 1800 bytes
SHA-256: daad3f347a4f42f432ee9983e619a7c063e36761dba5934b469418034847e28e
font_02_sfnt_off000105fa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x105FA 12592 bytes
SHA-256: 4c08602632d79de586a4e37ebacccd28028093825e43577a45eb0109bd2839fc
font_03_sfnt_off00012ea6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12EA6 4324 bytes
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e

Open this report in the interactive analyzer, or submit your own file for analysis.