Malicious PDF — malware analysis report

Static analysis result for SHA-256 83f52b261dfa42c0…

MALICIOUS

PDF

77.7 KB Created: 2021-03-20 02:37:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8c255b8f0fafeca673d366c4edba9bb0 SHA-1: 7d13088d56fa85db816d5727b286ed500cc3f5d5 SHA-256: 83f52b261dfa42c0467c05ed2e1754142292955daaf3a55a8e85e78ec85047e0
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to trick the user into clicking it under the guise of search results. No scripts were extracted, but the overall structure and heuristics suggest a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=little+river+shrimp+festival+2017+results
    • http://manovina.mypressonline.com/sat_subject_test_tutoring_online.pdf
    • https://static.s123-cdn-static.com/uploads/4443821/normal_60010af1a56d9.pdf
    • http://wolifote.getenjoyment.net/85960238739.pdf
    • https://static.s123-cdn-static.com/uploads/4459794/normal_5fe53cd2466e2.pdf
    • https://cdn-cms.f-static.net/uploads/4370280/normal_601034fd8d784.pdf
    • https://cdn-cms.f-static.net/uploads/4479902/normal_604d924201eb1.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://lamupilabixekuw.epizy.com/nanusenujopevokitusegis.pdf
    • https://uploads.strikinglycdn.com/files/55430273-6640-4481-88b7-2e1e969be688/36900942684.pdf
    • https://uploads.strikinglycdn.com/files/1df318b9-a7e9-4680-b6b0-dc386bd8e49e/dodge_grand_caravan_overheating_problems.pdf
    • http://kaxuwenewutexu.myartsonline.com/jazotopimegotonenu.pdf
    • https://uploads.strikinglycdn.com/files/8c0dfcc3-5142-4361-a2c7-b3d46812f2d1/cochlear_implant_components.pdf
    • http://rawigukegopafot.onlinewebshop.net/32451000002.pdf
    • https://uploads.strikinglycdn.com/files/a7aa6ebe-424d-4edd-8f93-689baea89513/jozenitumojumubug.pdf
    • http://fivawif.epizy.com/30000856117.pdf
    • https://uploads.strikinglycdn.com/files/3429e44e-1a4d-40b2-ba97-7998d8749e12/tafadelisenovuvalagikapa.pdf
    • https://uploads.strikinglycdn.com/files/5cf414cb-b8ef-4ab6-ad6a-db8c2208c3fc/sipokevuminaralopef.pdf
    • https://uploads.strikinglycdn.com/files/174b105c-864b-4009-8cdd-ac6d32055a33/84779231992.pdf
    • https://uploads.strikinglycdn.com/files/755f0ca8-14f8-434a-9392-7f7a70605bd4/black_baby_girl_shoes_3-6_months.pdf
    • https://uploads.strikinglycdn.com/files/f01be6e7-5dd6-464b-8b05-3845aa69259e/christmas_songs_for_electric_guitar.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f05d.bin
3b99f8b014d1cbcecd7d6ed7b4bdf25a07bb9924486705b319a7d45a216bfb33		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF05D 5548 bytes
font_01_sfnt_off00010324.bin
9402a08b32fbda691ffcfd1c99936a63869aec3653dc12a7dc58e94b85585459		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10324 11244 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.