Malicious PDF — malware analysis report

Static analysis result for SHA-256 82c2b6f3babfb5b4…

MALICIOUS

PDF

87.4 KB Created: 2021-02-27 18:27:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 203a81d908bae1c908e6386849422bcc SHA-1: 5e17de53b55899fe04aee547fb5c2387cc54eae9 SHA-256: 82c2b6f3babfb5b4a4ef8361173b2017f0707305e3f329786922c0e422eb1930
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that mimics a search query, likely intended to trick users into visiting a malicious site. ClamAV detection and ML classification strongly indicate malicious intent. While no scripts were directly extracted, the presence of external URIs and the overall detection profile suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=hoobae+meaning+in+korean PDF link annotation
    • https://nefarixutasirov.weebly.com/uploads/1/3/1/6/131606035/bobopatalajavu_ditezabu_rulabaju_guribixe.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4410714/normal_5ff2e0ee44d47.pdfIn PDF document text
    • http://ig-copyrightviolation.com/android_software_versions8ga3z.pdfIn PDF document text
    • http://jigitozunawada.66ghz.com/invicta_watch_battery_guide.pdfIn PDF document text
    • http://avit0.pro/49501275307jniez.pdfIn PDF document text
    • http://bewagubidebesun.iblogger.org/b._ed_date_sheet_aiou_2019.pdfIn PDF document text
    • http://wisecreditscore.info/courage_by_osho20pn1.pdfIn PDF document text
    • http://kuxogajow.iblogger.org/74239789622.pdfIn PDF document text
    • http://rigudozefogo.mypressonline.com/fluval_306_canister_filter_specs.pdfIn PDF document text
    • http://prosale.company/1398321642v2nrb.pdfIn PDF document text
    • http://instacopyrightcenter.com/cross_words_crossword_puzzle_cluejp0st.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/lixasifasi/organizational_chart_template.pdfIn PDF document text
    • http://tedonipevafipe.epizy.com/arteriovenous_malformation_uterus_ultrasound.pdfIn PDF document text
    • https://s3.amazonaws.com/zemigiduwagafu/14577827348.pdfIn PDF document text
    • https://s3.amazonaws.com/zevutebulaworel/livre_guide_touristique_rome.pdfIn PDF document text
    • https://s3.amazonaws.com/bomifabipi/56409887712.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e0f1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE0F1 6804 bytes
SHA-256: f6a2dd9b04bba0eadd2d62e925386be1f23803503dbdbe5995f206f17b707d63
font_01_sfnt_off0000f1f9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF1F9 5464 bytes
SHA-256: d0bfde6add76f84a0ecff873175eae9cf2af6435fcb4b248b63c9ebf31e39bc2
font_02_sfnt_off000104af.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x104AF 4960 bytes
SHA-256: ac0080a8791a586bdf76a819e167bf763ef718cc4e2b77ed30a47de32a34bfa6
font_03_sfnt_off00011580.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11580 10360 bytes
SHA-256: 6618eb7f6bd838f7013acfa346e2b0d8f8465a470b1f814f92914f50d3672116
font_04_sfnt_off0001393b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1393B 16492 bytes
SHA-256: 86f0cdb313824039da90733caace7ac13388a7bc5b61c62ee1289ca2c886f6f9

Open this report in the interactive analyzer, or submit your own file for analysis.