Malicious PDF — malware analysis report

Static analysis result for SHA-256 7f8666ea9db89ac7…

MALICIOUS

PDF

80.6 KB Created: 2021-05-20 06:39:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0ebe7972cc3776b7a16bf61c24f310ce SHA-1: ea31e19505b445ac9229bdc257a8b57d40e12636 SHA-256: 7f8666ea9db89ac78e15c9b47172527ce8d9c30cfaccedef5a2d83cafc8fbca8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though partially corrupted, suggests a lure related to MS-DOS commands to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=lista+completa+de+comandos+ms-dos+pdf
    • https://cdn-cms.f-static.net/uploads/4387230/normal_601d5df45d38d.pdf
    • https://static.s123-cdn-static.com/uploads/4454421/normal_5ffbf19f6767d.pdf
    • https://cdn-cms.f-static.net/uploads/4385030/normal_602d9399e5295.pdf
    • https://cdn-cms.f-static.net/uploads/4459185/normal_5fea2f24efbd0.pdf
    • https://static.s123-cdn-static.com/uploads/4500670/normal_5ff9ee48e3614.pdf
    • https://cdn-cms.f-static.net/uploads/4468814/normal_6033f635cc187.pdf
    • https://cdn-cms.f-static.net/uploads/4457854/normal_603914f183b9c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/lekelepowo/96179477695.pdf
    • https://uploads.strikinglycdn.com/files/5fd689d3-9baa-49ea-875f-2b591fb44714/the_vampire_diaries_season_8_episode_2_soundtrack.pdf
    • https://s3.amazonaws.com/rojalexipokadaz/how_to_punch_a_punching_bag_properly.pdf
    • https://s3.amazonaws.com/rogugagatuf/alcoholismo_en_adolescencia.pdf
    • https://s3.amazonaws.com/dixaleko/83053588194.pdf
    • https://s3.amazonaws.com/fibesezati/37674130850.pdf
    • https://s3.amazonaws.com/lovetijif/tigegepixotowunab.pdf
    • https://uploads.strikinglycdn.com/files/2c22afd1-4ac8-4f1f-971b-0431f5cefeb7/which_book_is_best_for_computer_science_class_12.pdf
    • https://s3.amazonaws.com/nisiwanolom/bullish_flag_formation.pdf
    • https://s3.amazonaws.com/posufij/72506661468.pdf
    • https://uploads.strikinglycdn.com/files/f7f2d178-51a0-4b07-9a55-1fbf01516932/what_race_is_ahsoka.pdf
    • https://s3.amazonaws.com/xoxaneral/gre_verbal_reasoning_practice_questions_with_answers.pdf
    • https://s3.amazonaws.com/baxekojojexusol/38242893353.pdf
    • https://s3.amazonaws.com/lovomijelun/nixixelif.pdf
    • https://uploads.strikinglycdn.com/files/8b330718-8aae-4f89-b06c-01550fd00721/25317683456.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eec7.bin
093ac8dfc301466f9535f3a41e433de99aeaa4a7240043ae0d31a7ebdcc3f561		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEEC7 4964 bytes
font_01_sfnt_off0000ff93.bin
2b0023ccbc514fb55ff43568d7ff606651d7b1c3dca204b7efa78d3c78d5f05d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF93 12192 bytes
font_02_sfnt_off0001252c.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1252C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.