Malicious PDF — malware analysis report

Static analysis result for SHA-256 8011496f37abc62a…

MALICIOUS

PDF

78.5 KB Created: 2021-03-16 10:14:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: 967b18140163b2202e03a6c9a22b6d4a SHA-1: f3ce1fe7204b59290381d5013b4285f6541fb62f SHA-256: 8011496f37abc62a86c5816f7f288e037309d252bc1dae3dac0e8da0f6a203e3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to a suspicious domain, which is likely used to deliver a secondary payload or conduct phishing. The presence of PDF-specific heuristics and embedded URLs suggests an attempt to exploit PDF vulnerabilities or trick users into interacting with malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=the+immune+system+peter+parham+garland+publishing+2014+4rd+edition+pdf PDF link annotation
    • http://lalexejiwisejul.iblogger.org/35424413469.pdfIn PDF document text
    • http://kieverts.xyz/is_the_baofeng_uv-5r_illegalskme4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4392210/normal_60209416a4123.pdfIn PDF document text
    • https://cdn.sqhk.co/vizoxaxijojo/hjMhfih/sawemu.pdfIn PDF document text
    • http://enots.space/navikekolopagakesekowid8j4y.pdfIn PDF document text
    • http://usacarins.com/vibraciones_mecanicas_ejercicios_resxxj35.pdfIn PDF document text
    • https://cdn.sqhk.co/bitowiso/fbpgJL6/jugelupirubezezumupamoles.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4407986/normal_603da890226e3.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/nitizobuv/pedax.pdfIn PDF document text
    • https://s3.amazonaws.com/gupojakami/c_compiler_code_blocks.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ec2d3276-24b4-4913-ac5e-fa49777a0a5c/ejercicios_de_limites_logaritmicos_resueltos.pdfIn PDF document text
    • http://bideliv.rf.gd/22960920583.pdfIn PDF document text
    • https://s3.amazonaws.com/labitajaxatufib/oahu_traffic_reports.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8f26eaa8-a507-4fb1-b978-b57c7e4ac4ad/hisense_50h7gb1_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e2437b8a-91d3-4d99-ac87-049b327f3c27/what_is_the_best_electric_dog_fence_reviews.pdfIn PDF document text
    • https://s3.amazonaws.com/purawuma/44375405702.pdfIn PDF document text
    • https://s3.amazonaws.com/xapota/bahut_pyar_karte_hain_audio_song.pdfIn PDF document text
    • http://bezumopure.rf.gd/60280933585.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de7e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE7E 6060 bytes
SHA-256: edbf31f73791e0060ad1d17c3558bbb0f3252b2fa19746acd577d53e23eb528c
font_01_sfnt_off0000f2fa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF2FA 10860 bytes
SHA-256: a98340b0a4785da35c2acad7e9da0ecfb96a17277b3ad5e9ecd5d4a3589d7772
font_02_sfnt_off00011849.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11849 16084 bytes
SHA-256: 6049f7be1eb58524b2bfe5e0ab34f4300347f26dbb23ab6ad605e3b0d5647553

Open this report in the interactive analyzer, or submit your own file for analysis.