Malicious PDF — malware analysis report

Static analysis result for SHA-256 81f8f382ff740b8b…

MALICIOUS

PDF

78.1 KB Created: 2021-05-30 22:54:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d0d6ef181512f8e0fb7d7b3e1903d13b SHA-1: d9ad2b6b247a2a52303e0773b7961004ddb5b698 SHA-256: 81f8f382ff740b8b296facdf02b5da421bd6b94d03c5249ede787d8c8756c111
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, suggesting a phishing or malware distribution attempt. The document body is heavily obfuscated, but the presence of the external URI is a strong indicator of a malicious attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/123?utm_term=fonctionnement+carburateur+a+membrane+pdf
    • https://cdn-cms.f-static.net/uploads/4492575/normal_602a85b3bdfa5.pdf
    • https://cdn-cms.f-static.net/uploads/4426812/normal_60300d7a1cbed.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/4a9e9ef6-0792-40d5-8512-1c666e89fd2a/nesirasefositufevotaj.pdf
    • https://uploads.strikinglycdn.com/files/8254235c-ab58-4b4a-9305-c546859f10d2/panasonic_cordless_phone_manual_kx-tg7871.pdf
    • https://uploads.strikinglycdn.com/files/7679bce3-9321-40cb-8d7c-8ae6688b3d69/reporting_multiple_regression_results_table.pdf
    • https://uploads.strikinglycdn.com/files/790cbcdb-242c-4858-97b3-1cf696016b52/93945483583.pdf
    • https://uploads.strikinglycdn.com/files/57760266-b14c-4375-96b6-9eb2b6b73a89/fejenaritorepiv.pdf
    • https://uploads.strikinglycdn.com/files/ccfe5b2c-ac3f-4163-aaf9-554ca47cb6e4/rumoru.pdf
    • https://uploads.strikinglycdn.com/files/d3845a52-2ebd-41fe-b7cb-5abed028d738/70498828353.pdf
    • https://uploads.strikinglycdn.com/files/4d363f55-e04f-48f3-a87f-ad7b42a61dd8/como_descargar_geometry_dash_2.11_para_android_gratis.pdf
    • https://uploads.strikinglycdn.com/files/203fe1cd-2d9b-4035-bdb6-d5dd16725641/zenojikojiwizilege.pdf
    • https://uploads.strikinglycdn.com/files/01410146-a63d-4776-bc4d-9b8d5b8f30c9/cards_against_humanity_big_black_metal_box.pdf
    • https://uploads.strikinglycdn.com/files/6c0feb31-c638-4875-baaa-600aa09789dc/92329025900.pdf
    • https://uploads.strikinglycdn.com/files/091ddd9c-71f6-450a-9b97-3439150839e5/78940192026.pdf
    • https://uploads.strikinglycdn.com/files/014194e4-3e1f-4fa1-b5be-27b0b62f2290/76235682692.pdf
    • https://uploads.strikinglycdn.com/files/88277124-4c2b-4707-ad26-5759e97354fb/xupuzodozozoge.pdf
    • https://uploads.strikinglycdn.com/files/d89d6b71-28f2-4b9b-a570-ebd2f338c226/cobra_kai_review_season_2.pdf
    • https://uploads.strikinglycdn.com/files/25cea357-3dfb-40e8-9203-76811474baad/wowaroke.pdf
    • https://uploads.strikinglycdn.com/files/e785a37e-416f-4b39-bf93-1311f50ace81/jematobazun.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f0b7.bin
c6911a21df48a809c4afcff0ae0dbc7f7b9286e5443a4435b78c528f222f1f97		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF0B7 5188 bytes
font_01_sfnt_off00010244.bin
a05d8b6b9cfbe561db8792a791a31448fc916d8a9f796c0fa3d952b1da457694		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10244 12480 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.