Malicious PDF — malware analysis report

Static analysis result for SHA-256 85ea33053a7e5ecd…

MALICIOUS

PDF

80.8 KB Created: 2021-03-05 03:17:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 5ff8b1b00ad70d29cd541dc98f3dcfea SHA-1: 5e02adfae641ab8bf45303da0469de760024f13d SHA-256: 85ea33053a7e5ecd6ce273df55d146bf139e1eebf58e69f1ce72975bc4799a64
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site for further exploitation. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the presence of the malicious URL is a strong indicator of a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/wix?keyword=uniqua+backyardigans+meme PDF link annotation
    • http://cz-nitrof.website/english_as_a_second_language_austin_texas78mk2.pdfIn PDF document text
    • https://powirubojeti.weebly.com/uploads/1/3/1/4/131482959/damesek_vixoder_gedasizipuze.pdfIn PDF document text
    • http://seomagnat1.online/colour-_block_pullover_hoodie_nike_sportswearepmlf.pdfIn PDF document text
    • https://sanijala.weebly.com/uploads/1/3/4/8/134889677/bakef.pdfIn PDF document text
    • https://gavurefeg.weebly.com/uploads/1/3/1/0/131070452/xebaz_buvaf.pdfIn PDF document text
    • http://sesesuruko.mypressonline.com/lukalopekoxaponadesi.pdfIn PDF document text
    • http://niwizonoleror.mywebcommunity.org/11001098520.pdfIn PDF document text
    • http://tehnotop.space/mrs_basil_e_frankweiler_quotes4fbul.pdfIn PDF document text
    • http://copyrightsupport-ig.com/63248031142tf6ko.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/rumezo/gramophone_cd_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f2f530fa-0c62-44b0-a280-9f51fe00621f/96230626341.pdfIn PDF document text
    • https://s3.amazonaws.com/towutoginadivu/89847884727.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/693e07ae-39f3-4ddf-935b-356f717580cc/best_quote_about_happiness.pdfIn PDF document text
    • https://30c0d994-bee2-4d79-bc91-d4aaa7251653.filesusr.com/ugd/0962d9_5937a165aa564953a39f94b69bc9c572.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/68ab514a-49b4-451b-838b-031cbf26b3dd/83614925997.pdfIn PDF document text
    • https://s3.amazonaws.com/juzowilipi/62495275574.pdfIn PDF document text
    • https://01d7ec8a-e38e-4e33-8c76-1be31754498b.filesusr.com/ugd/24d943_858a16619c3343f4be42fe1dea6c8f08.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/nitizobuv/diversity_and_inclusion_objectives_examples.pdfIn PDF document text
    • https://s3.amazonaws.com/xajowu/59761211244.pdfIn PDF document text
    • http://wejufutaz.onlinewebshop.net/galaxy_grand_prime_pro_price_in_india.pdfIn PDF document text
    • https://a40b6db0-1679-4e03-879f-ac5827b9aa7d.filesusr.com/ugd/dba42a_b6c39daeed434d5c8ba488961ae89298.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/37d8731a-6c06-4bd2-820b-dad82d659f6c/hp_pavilion_dv7-3160us_service_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6198209e-bbd1-4016-b3f9-03737a5f3961/does_bodyweight_training_burn_fat.pdfIn PDF document text
    • http://keregimuw.onlinewebshop.net/what_happens_in_vampire_diaries_season_8_last_episode.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f1d3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF1D3 5344 bytes
SHA-256: be189d5b4d9ce0db4c77325dee0d5a1c6cd6f40400d03d53e0ac924226567d43
font_01_sfnt_off000103d9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x103D9 10492 bytes
SHA-256: 722e4be9fae645d815260ea29db81f9bb50ff530553ed0985b255791802b8e93
font_02_sfnt_off00012788.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12788 4324 bytes
SHA-256: 1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361

Open this report in the interactive analyzer, or submit your own file for analysis.