Malicious PDF — malware analysis report

Static analysis result for SHA-256 810ce83256cdfb4c…

MALICIOUS

PDF

70.1 KB Created: 2021-05-10 08:14:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c4f1ed63edf34d48b3d06a129933abde SHA-1: e7417f5343eacacf11e469954c67cb240f29aafd SHA-256: 810ce83256cdfb4c3ab443b8b142f00b778e76048e4b9533e80ca44dad1f2f39
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL, likely intended to redirect the user to a malicious site. The ML classifier and ClamAV detection strongly indicate malicious intent. The presence of multiple URLs suggests a phishing or credential harvesting attempt, or a distribution point for further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pixomot.ru/uplcv?utm_term=add+up+cells+in+google+sheets
    • http://willtorock.com/wp-content/plugins/formcraft/file-upload/server/content/files/160912d41a2c1c---86956985506.pdf
    • https://www.saltriot.com/wp-content/plugins/super-forms/uploads/php/files/dc19d175cc6566d7f12441c7da928d6e/xonap.pdf
    • https://phase1acoustics.com/wp-content/plugins/formcraft/file-upload/server/content/files/160893712e6106---26809616079.pdf
    • http://abogarestudio.com/userfiles/file/56163604387.pdf
    • http://springswellness.net/wp-content/plugins/formcraft/file-upload/server/content/files/160982ff715c76---rumadefisujitabifevomi.pdf
    • http://aclamerica.com/customers/CMS-IMAGES/file/54430455397.pdf
    • http://localhomesales.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1606d26ebc105f---66765789151.pdf
    • https://adm.allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/39c483424b150d6c52d705fe6603685c/xorevodotexepijodepilu.pdf
    • http://mfplus.ba/wp-content/plugins/formcraft/file-upload/server/content/files/160783064b6cd9---furamamuxesixisusotemavib.pdf
    • https://backcountryplayground.com/wp-content/plugins/super-forms/uploads/php/files/e3255eeb7762ebcac238dac94b77e15f/83563121725.pdf
    • http://akkoryazilim.com/userfiles/file/pelodadibegosu.pdf
    • https://abofahed.com/userfiles/file/kagivusaxo.pdf
    • http://www.onegelha.com/wp-content/plugins/super-forms/uploads/php/files/7317e0b070dc1efb986976b375d9c4f8/bizixu.pdf
    • http://jnnycc.org/userfiles/file/2128677532.pdf
    • http://caribsplash.org/wp-content/plugins/formcraft/file-upload/server/content/files/160954ed8cc88c---gorimasopinuv.pdf
    • http://mouaumfb.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075b54e59f40---puner.pdf
    • http://www.wallisandemmanuel.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609557417fbff---kafeku.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d63f.bin
a9d5e28122318e6e756600aa20fa711fc45e965c8090b89da5ea32fca91a45b9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD63F 5016 bytes
font_01_sfnt_off0000e752.bin
a2c40ab0c879e0f6f94a44b0e4ba35947185c089902496f551aedb9fb8c8208c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE752 10600 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.