Malicious PDF — malware analysis report

Static analysis result for SHA-256 8850d7579942def1…

MALICIOUS

PDF

66.5 KB Created: 2021-02-10 14:48:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 5395bd6cdd6cd6ed56b213b0a1caaa0a SHA-1: 78e07dfacee5c0dd0fe7b8fe4538ddefe376aa86 SHA-256: 8850d7579942def1fcf633af4b4878bea66e6c567e219fbb77081ff1e85241d3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The ML classifier and ClamAV detection strongly indicate maliciousness. The document contains embedded URLs pointing to suspicious domains, suggesting a phishing or malware distribution attempt. The presence of PDF-specific heuristics like PDF_URI further supports the analysis of malicious links within the document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/aws?utm_term=ksubi+shorts+size+guide PDF link annotation
    • http://harkateine.fun/sufitikoginupexiwuwazi0mh3.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4388163/normal_5ffac11498abb.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4445550/normal_5fec76504cf79.pdfIn PDF document text
    • http://sberbank.link/kujamudururia5r8.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417998/normal_5ff3cbe57d4d9.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4403676/normal_5fe3834423e02.pdfIn PDF document text
    • http://insuranceautousa.com/99705158064m9u1t.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4461516/normal_5fd104df75b7b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4444649/normal_600a96e699391.pdfIn PDF document text
    • https://cdn.sqhk.co/zudilubal/Pib4yic/98439254214.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383308/normal_6017d42d77733.pdfIn PDF document text
    • http://show-visitor.xyz/crazy_taxi_driver_apk_mod0cnd1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4470409/normal_5fcbaa07c0c0c.pdfIn PDF document text
    • https://cdn.sqhk.co/wupofolizaj/MR02egi/drive_parents_car_insurance.pdfIn PDF document text
    • http://bubble1.space/ratereposebojakul5dc7b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4482623/normal_5fc72a170c1e8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417049/normal_601a17f2f3459.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4478131/normal_5fc839a6e5726.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450727/normal_600f4f671c475.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c5f4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC5F4 5004 bytes
SHA-256: 3efeaa5e5e797afe1d8c5a9e4c58eebabbaac90708dc8d70eeaf90305024c9b3
font_01_sfnt_off0000d6fc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD6FC 11280 bytes
SHA-256: def09ea145b324d5fa23878a46a5ad9f02cb91d1a7241d92dc08201eb97a4d8a

Open this report in the interactive analyzer, or submit your own file for analysis.