Malicious PDF — malware analysis report

Static analysis result for SHA-256 81746552aa46dfc7…

MALICIOUS

PDF

81.5 KB Created: 2021-03-16 00:11:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 63b4fc293cb23b57d9513fa9cb2547a0 SHA-1: 64d4be4e99019c212fddad69c4145b7e338b16ba SHA-256: 81746552aa46dfc78bee6a578d90a3d27e6145bcf75e3372e3eb7015090aafe4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a specific detection name indicating phishing and trojan characteristics. An embedded URI points to a suspicious domain, suggesting a lure to a malicious site. While no scripts were explicitly extracted, the PDF structure and embedded URI are strong indicators of a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/123?utm_term=bleach+ost+4
    • http://wirelosine.22web.org/integrated_math_2_student_journal_answers.pdf
    • https://cdn.sqhk.co/bisuligiga/fFAggG6/hip_hop_producer_pads.pdf
    • http://mujusudi.iblogger.org/duwetulagazikunoximapa.pdf
    • https://cdn.sqhk.co/tikexumivu/Jgficij/nccn_guideline_brca_testing_2018.pdf
    • https://cdn.sqhk.co/pasepizut/ohdLjf8/nuxapi.pdf
    • http://rupuvuk.22web.org/split_type_air_conditioning_system.pdf
    • http://vykupavto54.ru/xisasopanekatuveluzolofidu4ly.pdf
    • http://goodshopsales.xyz/remington_pg6025_chargeryozex.pdf
    • https://cdn.sqhk.co/vitimosugu/cjgvLhf/starlink_beta_sign_up_not_working.pdf
    • https://cdn.sqhk.co/janawezexoj/dl1FjiD/zoxazizusumuguzug.pdf
    • http://nunegotopexipo.iblogger.org/bengali_song_hemanta_mukhopadhyay.pdf
    • http://copyrightreports.com/baltimore_catechism_onlinez4ibx.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • http://fikexole.rf.gd/queen_size_bed_sheets_near_me.pdf
    • http://fujatelet.epizy.com/should_i_get_a_stray_cat_neutered.pdf
    • https://s3.amazonaws.com/redegelesibif/sap_data_warehouse_concepts.pdf
    • http://kusofiwu.epizy.com/bifiwukenuferubo.pdf
    • https://s3.amazonaws.com/xomudufe/boxupupuwof.pdf
    • https://s3.amazonaws.com/wulagisi/68737585815.pdf
    • https://2a6c20f5-091f-48b5-a5be-bf749919b1f6.filesusr.com/ugd/3794ad_d42d584333274a45a84e8c9b2cbfd58b.pdf?index=true
    • https://6998e30b-c911-4113-ab34-4c15204891c7.filesusr.com/ugd/429b25_c15502792db04442a61b89cc13c49850.pdf?index=true
    • http://lazefofitixonu.epizy.com/makro_specials_download.pdf
    • http://tajomum.epizy.com/sepak_bola_fifa_mod_apk.pdf
    • http://legujajojozete.epizy.com/wastewater_treatment_plant_process_flow_diagram.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d409.bin
1876e9e6a594d364f05243d753afb8cab75f5097837e68ae34c02ab2e43eb11b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD409 10080 bytes
font_01_sfnt_off0000f5e7.bin
5c7f3dcbc6931d4c1e239e6463f8272259d7a0d94faf95c8f7cb67817f9402ac		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF5E7 4928 bytes
font_02_sfnt_off000106ad.bin
e58bc191921e7825d911d50be0e9bd055eb226b622df44e74663e509fbc03905		 pdf-font-stream PDF embedded font (sfnt) at offset 0x106AD 10544 bytes
font_03_sfnt_off00012a8b.bin
00717eaeb6c3cc30d1a35c08d5966442abf5e42b8ea9d38e469d6f0a588fb52d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12A8B 3364 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.