Malicious PDF — malware analysis report

Static analysis result for SHA-256 86fa6df2156ee319…

MALICIOUS

PDF

77.8 KB Created: 2021-03-04 14:06:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: c636cb5317b9f89c7b88013cc8c2461b SHA-1: 027a152c8555427ebf497d228314ff1f76f9cd31 SHA-256: 86fa6df2156ee3191b19fdf55a48593a6fe108b8f580e3cca52685246341e17f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The document body, though partially garbled, suggests a lure related to car maintenance, specifically resetting a service engine light. The embedded URL points to a suspicious domain, likely serving as a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=how+to+reset+service+engine+light+on+2000+chevy+silverado PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4372985/normal_5ffae3da465cf.pdfIn PDF document text
    • http://ifeelgood.club/history_of_public_education_in_the_united_states_timelinevzlsm.pdfIn PDF document text
    • http://tehnotop.site/51284530102n2goe.pdfIn PDF document text
    • http://bridgecommerce.com/19262697561w1kdz.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4476947/normal_5fc7d9f3beef7.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jolituzoji/97760151290.pdfIn PDF document text
    • https://s3.amazonaws.com/dazuxujepov/fobujamilojezekopapuso.pdfIn PDF document text
    • https://s3.amazonaws.com/fadedosi/34155902288.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f1f80664-9043-44a9-977f-658540cb9bd0/oracle_sql_decode_null_example.pdfIn PDF document text
    • https://s3.amazonaws.com/popilo/gadumasezuxumokajo.pdfIn PDF document text
    • https://s3.amazonaws.com/ropidadegaxut/pagorigavubilizemapama.pdfIn PDF document text
    • https://s3.amazonaws.com/luxaduzimase/are_oil_filled_space_heaters_good.pdfIn PDF document text
    • https://s3.amazonaws.com/nelizenejakarug/android_browser_import_bookmarks.pdfIn PDF document text
    • https://s3.amazonaws.com/sazixipame/rules_of_exponents_worksheet_with_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/69faebc6-77a9-4140-a5f5-4a5e5a0e3200/pazawonevigepafowat.pdfIn PDF document text
    • https://s3.amazonaws.com/jokotaziweluge/39170428707.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d84348ea-3ac2-4fd7-8d90-16c627f90ae7/fewijun.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f57e0bf6-c59c-4017-8bb6-eead382f0950/2012_chevy_silverado_lt_review.pdfIn PDF document text
    • https://s3.amazonaws.com/baxadelefofibuz/12032158921.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1c356e90-8e70-4fd8-a653-cd280347b7cd/home_zone_security_triple_head_led_motion_sensor_security_light.pdfIn PDF document text
    • https://s3.amazonaws.com/wowonesoribu/93330698817.pdfIn PDF document text
    • https://s3.amazonaws.com/lotibabakuj/62184064983.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f158.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF158 5688 bytes
SHA-256: 2c7c0f9cfabf4b7a209bc43e602d22eb070e82e07c15842cffe7841281a89ab1
font_01_sfnt_off000104ca.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x104CA 10692 bytes
SHA-256: 13e06a48a270110975b3a88a7dc291c867a8cf6492c8dd9238c7dc38d39c6cac

Open this report in the interactive analyzer, or submit your own file for analysis.