Malicious PDF — malware analysis report

Static analysis result for SHA-256 82765e9673802056…

MALICIOUS

PDF

75.5 KB Created: 2021-03-16 06:02:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 24b22a8df5bb9aaf208fda5274897591 SHA-1: df1bf2fc8b08abe1e80e530ef1b1b53aafccd065 SHA-256: 82765e96738020560d922b4931b90b4dcb33e1307557a18a378c99765fa3a34c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains an embedded URL pointing to a malicious domain, likely intended to deliver a second-stage payload. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan. The document body, though heavily obfuscated, appears to be a lure related to a repair manual.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/award?keyword=1995+buick+century+repair+manual+pdf
    • https://cdn.sqhk.co/xoberuweri/gihdNia/canvas_teacher_app_for_pc.pdf
    • https://cdn.sqhk.co/zilidadakole/gfhgJie/downhill_mountain_bike_helmets_for_sale.pdf
    • http://raffle.website/notes_of_metallurgy_class_12dxb0y.pdf
    • https://xejuxomezul.weebly.com/uploads/1/3/1/6/131637030/8f5d6a0c.pdf
    • http://itasummer.fun/best_customer_service_interview_questions_and_answerskfxbz.pdf
    • https://cdn.sqhk.co/wajewukudino/chj5hfH/54958238906.pdf
    • https://jovovanin.weebly.com/uploads/1/3/1/8/131871717/05b265862.pdf
    • http://badgesverified.com/debt_the_first_5000_years_epubqy7yn.pdf
    • http://ruseseru.iblogger.org/carplay_iphone_7.pdf
    • https://woxufojobufuv.weebly.com/uploads/1/3/0/7/130739326/2202483.pdf
    • http://neximegimukik.iblogger.org/somorefopelimamafefosotu.pdf
    • https://befunopokoxa.weebly.com/uploads/1/3/5/3/135327779/deritemivubud-nesike-zamusin.pdf
    • http://kismykeitio.best/14535011141srzju.pdf
    • http://fullpisetc.ru/easy_screen_recorder_crack_appxtw02.pdf
    • https://cdn.sqhk.co/zogobadakedu/icP4Jzd/vumonofotuwomodoz.pdf
    • https://cdn.sqhk.co/feripamapuv/hshejbO/8093942754.pdf
    • https://jotonude.weebly.com/uploads/1/3/1/3/131398177/sezatepafupumez_lanigu_remutiwiluvir_soruz.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://c039f79f-855f-4b64-8838-30138aeea086.filesusr.com/ugd/6b78cb_9f4c8f1e3dfe471587103976fa34c0b2.pdf?index=true
    • https://203aa715-7352-46b1-b16b-5d0aeeaa27a2.filesusr.com/ugd/0582e0_89d47290e0ad492b9995d3caf1050bea.pdf?index=true
    • http://jabefipe.epizy.com/blender_game_engine_tutorial_espaol.pdf
    • http://penisofitomi.epizy.com/cuisinart_pro_classic_7_cup_food_processor_how_to_use.pdf
    • http://zinolaj.rf.gd/67828544989.pdf
    • http://felobiziwikegu.rf.gd/aplasia_medular_pediatria.pdf
    • http://pikuvideposem.epizy.com/nogatavefo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e904.bin
24f39563918aaf177737bfeb4a90906b297761496fcd1ccd55dc2b5faa8d2e5e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE904 5664 bytes
font_01_sfnt_off0000fc42.bin
d4a086bcfb08463ee8db24b454c0f49ed54d3f016f5818db649dcc8fae576c95		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC42 10528 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.