Malicious PDF — malware analysis report

Static analysis result for SHA-256 84e40a1bce2e9267…

MALICIOUS

PDF

71.1 KB Created: 2021-05-12 18:59:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 298e96e77d9fb999133efb4a7e851415 SHA-1: 2ae0b06b23eaf9c9e724f0b6f54058a99d472f9f SHA-256: 84e40a1bce2e9267ce6db10b345598def72194b5a6e7ce3b97b9dcfd958f6a25
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was identified as malicious by a ML classifier and ClamAV, indicating a high likelihood of malicious intent. The PDF contains embedded URIs that point to external resources, suggesting a phishing or credential harvesting attempt. While no scripts were explicitly extracted, the presence of embedded URLs and the PDF structure itself are indicative of malicious activity, likely related to spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://laxmigrouppune.com/wp-content/plugins/super-forms/uploads/php/files/557846ec612674a6ff581331c9bc6db2/setemudepuvuxiv.pdf
    • https://ludifrance.fr/userfiles/file/85833139055.pdf
    • http://clearlakesd.org/wp-content/plugins/formcraft/file-upload/server/content/files/16078b97ed4032---nosale.pdf
    • https://microfocus-realize2020mea.com/wp-content/plugins/super-forms/uploads/php/files/3bc7435345abdea16b078d9aaf3bd217/pimiresa.pdf
    • https://trsbarriersdirect.com/wp-content/plugins/super-forms/uploads/php/files/evi927eok539ub1j49r2kthbbu/jofadofinefakuziziwiri.pdf
    • https://pluckywize.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f1713e76b0---39203218901.pdf
    • http://angarakshaksecurity.com/userfiles/file/43376200289.pdf
    • http://paymentsbusiness.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1607354e563aad---rabasalifofugojegozum.pdf
    • http://soundreaming.org/wp-content/plugins/super-forms/uploads/php/files/6fe7f2a1ab8216279071a8f3b3f68fd2/16311882870.pdf
    • https://apoc.com.au/wp-content/plugins/super-forms/uploads/php/files/6fa547faf504c4a35309ccc976baaae6/xupofarevepi.pdf
    • https://thewentworthco.com/wp-content/plugins/super-forms/uploads/php/files/69div8pgnk1gl5tnl3e7sghln3/gusudimujifabutisaw.pdf
    • https://www.ediliziaindustriale.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609832b59664f---83530841534.pdf
    • https://churchosonline.com/wp-content/plugins/super-forms/uploads/php/files/e50d39e0b97b8d7d392a1e29a355484f/setawekologijerizokolelus.pdf
    • https://realestateconnect.biz/wp-content/plugins/super-forms/uploads/php/files/j6mgg6vu7pvm4e5c2qtalsigr6/88608911514.pdf
    • https://rebates.forex/wp-content/plugins/super-forms/uploads/php/files/jj01cqt7mo3q8g0or1h5m37q84/zuzokuxu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://feedproxy.google.com/~r/skout/mBVl/~3/FevRqgeaUVY/uplcv?utm_term=cabinet+vision+10
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ccf4.bin
cdedcd9a3a6d620f628f7b5a1a5297b76f317285a31cf95f648fe3fc5221c92f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCCF4 4756 bytes
font_01_sfnt_off0000dd38.bin
2e8b99df1c615508f5a7eede24996daa9a8897a0f488d919892a011b97239a52		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDD38 10808 bytes
font_02_sfnt_off000101eb.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101EB 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.