Malicious PDF — malware analysis report

Static analysis result for SHA-256 8684c39ca620732d…

MALICIOUS

PDF

75.2 KB Created: 2021-03-19 16:29:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 120c5c1fb0e3e19ad61afff17bef0b44 SHA-1: d41c07167bbcad04e1c7637a9833e0cb4bfdde7e SHA-256: 8684c39ca620732dc2507bcac5de6a92a2d9d924b6bea2200520762433b3bc95
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URL that directs users to a suspicious domain, likely to host a malicious payload or phishing page. The document body, though heavily obfuscated, contains text related to a 'Kingsoft corp ltd annual report', suggesting a social engineering lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/123?utm_term=kingsoft+corp+ltd+annual+report PDF link annotation
    • https://cdn.sqhk.co/bojowagawire/hfJihgd/hornblower_san_diego_discount.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4386347/normal_5febc065540ef.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4422658/normal_6003617c7ac1c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476938/normal_601be62f91c80.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4475859/normal_6041c5bc0e6f3.pdfIn PDF document text
    • https://cdn.sqhk.co/lafuwexale/ihX1Kie/best_offline_first_person_shooter_games_ps4.pdfIn PDF document text
    • https://cdn.sqhk.co/tifapoxur/dCxxNnr/free_robux_loto_2020_para_pc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481282/normal_60404071445ce.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378165/normal_60136a221f1c0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451744/normal_6021a3da4a9fc.pdfIn PDF document text
    • https://cdn.sqhk.co/kifuzopeko/jfgi41w/soccer_skills_videos_download_mp4.pdfIn PDF document text
    • https://cdn.sqhk.co/nozedimasav/Vgf34ic/21513153999.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4501042/normal_5ff2a2822d967.pdfIn PDF document text
    • https://cdn.sqhk.co/viwitukaz/c5jjmhc/7279889788.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://923a8ca3-316b-4844-b38f-9bc955ad4852.filesusr.com/ugd/312e0e_4f68168ff51742989146d9ae966b9923.pdf?index=trueIn PDF document text
    • https://50bf384a-eeac-4f26-a262-e2ba1a5e00ba.filesusr.com/ugd/17159d_985d23cd1616469493375fd2c493e8f4.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/65b1681b-0fa8-442e-9af6-0f599b4bbcff/lozitaxeraruxidiwil.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8c938f22-f223-4ce4-8416-685f2a4f46d6/17755270861.pdfIn PDF document text
    • https://eb62986f-0112-409a-9ebe-777412bc5c19.filesusr.com/ugd/26938b_53b6566684bf41d7812663e94f58ec63.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/56f4105d-8f97-4af1-9a51-c4bf24161c14/cs_lewis_mere_christianity_book_3_summary.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3248e498-1b6b-4305-9e22-b3e4550ead4c/what_is_the_most_reliable_brand_of_top_load_washer_and_dryer.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db59.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDB59 5176 bytes
SHA-256: 082fc9b3ef44f05750ec4341878a51e11d45ea5b9def09c9397efa31773dfee2
font_01_sfnt_off0000ecfe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xECFE 10624 bytes
SHA-256: cfcb255c922c2128fc0141637531ffe1126cddbe117b5c9ccd2209806e019031
font_02_sfnt_off0001113e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1113E 4324 bytes
SHA-256: 9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2

Open this report in the interactive analyzer, or submit your own file for analysis.