Malicious PDF — malware analysis report

Static analysis result for SHA-256 8091e66d6d068f01…

MALICIOUS

PDF

80.9 KB Created: 2021-05-06 20:57:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 608b9ad4f66986e5df626012cbcbdfb4 SHA-1: 60d69c3b5ad2a6a621c11ae4b1f593c0f1a5001c SHA-256: 8091e66d6d068f012006f20b2e36c94d1f480a48768f99de5b188fa000b7ef09
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest an attempt to deliver a malicious payload or phish for credentials.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=percy+jackson+and+the+lightning+thief+review
    • https://borubuzas.weebly.com/uploads/1/3/4/0/134042729/f7232787aa5.pdf
    • http://mimivamefigupe.sportsontheweb.net/gidadinonow.pdf
    • https://static.s123-cdn-static.com/uploads/4418985/normal_6004a4e65b813.pdf
    • https://cdn-cms.f-static.net/uploads/4369638/normal_600e73ef86c23.pdf
    • https://bunekapizo.weebly.com/uploads/1/3/0/9/130969144/sabofuwaguwaxadaxam.pdf
    • https://resodarapasak.weebly.com/uploads/1/3/4/6/134659305/7a01506.pdf
    • https://cdn-cms.f-static.net/uploads/4448129/normal_605524aa5b4d9.pdf
    • https://gozerezujokosas.weebly.com/uploads/1/3/4/8/134856803/sigukaj.pdf
    • http://lutirojibafap.sportsontheweb.net/tisinanom.pdf
    • http://riwozizedilar.mygamesonline.org/musculos_rotadores_de_cadera.pdf
    • https://burekanokem.weebly.com/uploads/1/3/1/0/131069897/tekarubuxepowamadab.pdf
    • http://kijumubafenu.mypressonline.com/45324362241.pdf
    • http://tikixoji.mywebcommunity.org/92103739887.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/9ac0c6f8-714e-4438-9c31-4f0a8c43c70d/71019008590.pdf
    • https://uploads.strikinglycdn.com/files/bf585b42-beb7-4c8f-84e9-2a1133864d9b/how_to_complete_lean_canvas.pdf
    • http://kegigija.atwebpages.com/emotion_wheel_pillow.pdf
    • http://kikukuvikato.myartsonline.com/path_to_glory_cyberpunk_2077_explained.pdf
    • https://uploads.strikinglycdn.com/files/876d289b-e2e2-4f60-9323-75f9be8319e2/maya_angelou_poem_woman_work.pdf
    • http://titugol.atwebpages.com/1099636314.pdf
    • https://uploads.strikinglycdn.com/files/169b353f-e6e1-4067-9555-01c715a033f2/everything_pachislo_manual.pdf
    • http://kipejefanowisu.atwebpages.com/artificial_intelligence_a_modern_approach_3rd_edition_solutions_manual.pdf
    • https://uploads.strikinglycdn.com/files/f0c1fc5c-d461-4f13-b1ce-2b90dc2b373e/how_to_study_for_washington_drivers_test.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f138.bin
c87e728440a6c9eb5bee5608ed529670860b2f7b7c077cb9a2c1ae49968da102		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF138 5468 bytes
font_01_sfnt_off000103e3.bin
86137416020bd3ea890add85f7679074943e0f5adca441782e31a2728cfb2545		 pdf-font-stream PDF embedded font (sfnt) at offset 0x103E3 10424 bytes
font_02_sfnt_off000127b8.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x127B8 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.