Malicious PDF — malware analysis report

Static analysis result for SHA-256 86e08cf7a50ec5cd…

MALICIOUS

PDF

82.5 KB Created: 2021-03-21 22:33:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: db158d1750f054f7f2b9aefc792d60c4 SHA-1: e1ed823247cc314587edfe5d3338d3502ca970d4 SHA-256: 86e08cf7a50ec5cddf592df9433537f93627d74ee7cbade50536ac8ae4dea3a8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, which is a strong indicator of a phishing or malware distribution attempt. ClamAV detection and ML classification further support its malicious nature. The document likely serves as a lure to direct users to malicious content hosted on the external URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/wix?keyword=7th+grade+math+final+exam+common+core+pdf
    • https://cdn.sqhk.co/worijekegir/gieRjfj/83057155358.pdf
    • https://cdn.sqhk.co/tefozakozup/fATUmni/power_hover_mod_apk.pdf
    • http://japegemugivonen.22web.org/sony_dslr_a300_battery_charger.pdf
    • https://cdn.sqhk.co/jopubelo/ypgidgH/zodexidugadogubex.pdf
    • http://blablablacar.online/28941654472d6wi.pdf
    • https://cdn.sqhk.co/koxajavu/jgvuNhg/amazon_music_family_plan_cost_uk.pdf
    • http://delojenopow.66ghz.com/49990049146.pdf
    • https://cdn.sqhk.co/ferorigife/5iiCjfb/strike_back_elite_force_fps_unlimited_money.pdf
    • http://ritual-venki.online/sword_art_online_characters_names_and_pictures48j60.pdf
    • http://laxana.ru/ryzen_2600x_overclocking_guideq6h7b.pdf
    • http://216tilford.com/50369637597k23uj.pdf
    • http://usesol.xyz/79225565575p8l4n.pdf
    • http://umkatrade.ru/canon_vixia_hf_g4059ak3.pdf
    • https://cdn.sqhk.co/puwipaneke/BFAgcco/datotetuxagofibo.pdf
    • https://cdn.sqhk.co/foxoxaze/C6jiPja/lemowavizewebibugapixaxe.pdf
    • http://presalle.xyz/nemelegojepz7ycs.pdf
    • http://kotowis.22web.org/62306679633.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/a64196b9-6b2d-4aec-903a-8f086193313f/is_pensacola_a_spring_break_destination.pdf
    • https://uploads.strikinglycdn.com/files/6b0ab534-1fce-455f-95e2-7c2fc85f67bb/38633032957.pdf
    • https://uploads.strikinglycdn.com/files/1f9d2dc9-f89e-48c0-ad0d-90fed8c9afb5/the_nature_of_code_by_daniel_shiffman.pdf
    • https://uploads.strikinglycdn.com/files/c61daec1-db1f-4c1f-8584-b99415d54574/15568615238.pdf
    • https://uploads.strikinglycdn.com/files/4130dcaf-7b2a-4a41-8f9e-3410ca534a61/gopro_hero_3_plus_battery_bacpac.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f22b.bin
127b44c9f93874c96d25eb7ddc4688780d8877ce931cf296363fb5748d8d514b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF22B 6744 bytes
font_01_sfnt_off00010312.bin
1b641e71ae20e6b9277e9827c05817f22ddc6451c5f0f5c4bebc74bfabdaa2eb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10312 5444 bytes
font_02_sfnt_off00011582.bin
4a39eb9fed275fed8e4be36012c1789f5d297df9d4f169e716e0c6a109b93fca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11582 11304 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.