Malicious PDF — malware analysis report

Static analysis result for SHA-256 7f9fe81d51cc7e46…

MALICIOUS

PDF

190.4 KB Created: 2021-03-18 00:25:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: eb1c36629e520d78171fb70a32ea3531 SHA-1: b91015a9606b614d554bbbb1984853434e60abec SHA-256: 7f9fe81d51cc7e460ff69b7a8b47b3892a49fca3cf740d8dca8064980b620fb8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely used to redirect the user to a phishing site. The document body contains garbled text, suggesting it's not intended for direct user interaction but rather to host the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wix?keyword=cpo+science+answer+keys
    • http://erogan-encolumbia.site/apache_ignite_tutorialbfbzt.pdf
    • http://wugupomovupa.sportsontheweb.net/15159523052.pdf
    • http://fudoviwil.mywebcommunity.org/how_to_make_cajun_chicken_pasta_in_instant_pot.pdf
    • http://rawitotizoxuk.scienceontheweb.net/grammar_games_and_activities_2.pdf
    • http://dewikul.22web.org/cdf_relationship.pdf
    • http://fopijuzege.22web.org/93379445996.pdf
    • http://zupedaganivo.66ghz.com/sepipemopo.pdf
    • http://forkidsshop.online/do_they_find_percy_in_the_son_of_neptuneaiwmm.pdf
    • http://roflan.site/magilipemej1dm73.pdf
    • http://boldly-grow.com/algebra_1_system_of_equations_word_problemsyk35s.pdf
    • http://xupokaxe.medianewsonline.com/runifasofujufibil.pdf
    • http://rozogididibusar.sportsontheweb.net/the_history_of_north_american_steam.pdf
    • http://kavademive.sportsontheweb.net/how_to_get_more_views_on_your_business_facebook_page.pdf
    • http://power-guard.shop/samsung_s4_user_manual08ies.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://vefofiben.rf.gd/sketchup_pro_2020_license_cost.pdf
    • http://zilazop.rf.gd/aadhar_card_form_in_marathi_download.pdf
    • http://jikirukuda.rf.gd/vijakizenasusapofo.pdf
    • https://4b5f4e46-8b81-4257-bf39-61fc08ba57b0.filesusr.com/ugd/7ea8bb_246ed78ae65448bd8e6ca1dff92c9a04.pdf?index=true
    • http://xibupafuvobiluk.rf.gd/73804020527.pdf
    • http://zepogofeto.epizy.com/29674484716.pdf
    • https://737c154f-ca75-4484-807d-9d5c19d76377.filesusr.com/ugd/7e84b7_9a90ddb643e84598b782bc605de082e6.pdf?index=true
    • https://02bc4616-4eae-4b38-b2c9-0e654f754ee0.filesusr.com/ugd/069df5_20f07d3b9e0d427884d5ec20f8ffe24d.pdf?index=true
    • http://bawavejukedosuv.epizy.com/vintage_border_frame_vector_free.pdf
    • https://ca6b24e6-01cd-4368-a310-1df05077a315.filesusr.com/ugd/11b39a_ba21632e04fd425492b51ee27849a888.pdf?index=true
    • https://69f6cc44-9198-4e41-bafa-43503dba92bf.filesusr.com/ugd/dec231_bba7a625a7664ac3b0328848fbd362b7.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002b180.bin
a0b434e5b8913d131d2adbc58629598a85500078da6a810052062164790736e6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2B180 5056 bytes
font_01_sfnt_off0002c2dc.bin
a0880dcbcb20af8b91d0270e600861a4cd3c1b239fdd205a3a4fd7f0cb72799c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2C2DC 11404 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.