Malicious PDF — malware analysis report

Static analysis result for SHA-256 888dc849a1e2ffa7…

MALICIOUS

PDF

108.2 KB Created: 2021-03-23 00:03:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9d708bb0c8f6e86b079cd8951703371a SHA-1: 95e4b8b211129e469de97e6512bb777dd9927298 SHA-256: 888dc849a1e2ffa7f0e1d82e26cbe58cc69c73ca04216cfbde4fc72fda192b38
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains an embedded URI pointing to a suspicious domain, likely used to host a malicious payload or phishing page. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest it's designed to redirect users to a malicious site, potentially for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9984

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/123?utm_term=sentimental+journey+doris+day+sheet+music
    • http://donbetosstreettacos.com/739899234883qjc8.pdf
    • http://fusobilel.iblogger.org/roland_fantom_x6_keyboard_workstation.pdf
    • https://cdn-cms.f-static.net/uploads/4386834/normal_600b9f11d5d2f.pdf
    • https://cdn.sqhk.co/vetedaxuzele/jpgfibh/taj_frozen_crushed_ginger.pdf
    • http://matrixbicycles.com/28395626426hwrpa.pdf
    • https://cdn.sqhk.co/vafegijateno/gj1idji/space_decor_dream_home_design_apk.pdf
    • https://cdn-cms.f-static.net/uploads/4402250/normal_6032c6cfb9e71.pdf
    • https://cdn-cms.f-static.net/uploads/4450037/normal_60547407249ee.pdf
    • http://reactivaperu-viabcpi.com/vavejobojigesifubq5j8h.pdf
    • https://cdn-cms.f-static.net/uploads/4366029/normal_604e83da56114.pdf
    • https://static.s123-cdn-static.com/uploads/4472503/normal_5fdf4cda7a935.pdf
    • http://youralteragoods.com/bimofimxn082.pdf
    • http://jakebaxujimug.22web.org/forex_bible_free_download.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • https://uploads.strikinglycdn.com/files/4c94de80-0f75-441a-96f7-7c13d37dc56a/41177400033.pdf
    • https://720c7b34-a033-4bf0-83ea-6be17de98aa2.filesusr.com/ugd/03ef8e_00cd23619ecc43969d28234d93f1071c.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b1085026-5f47-413f-a853-3824407e9114/economic_loss_doctrine_affirmative_defense.pdf
    • https://36fc1fe3-b646-4cc1-b6e9-de51469aea27.filesusr.com/ugd/3eb4bd_0468fca28e544217a0a0dfbcde28deaa.pdf?index=true
    • http://netubufetolanup.rf.gd/british_council_english_grammar_book.pdf
    • https://6a67fe2d-6248-4fdb-84bb-1def1268cff8.filesusr.com/ugd/599026_93f665f1634b47c18af704fa3c4aa047.pdf?index=true
    • https://uploads.strikinglycdn.com/files/afdf4f4a-9928-4928-a43c-d37265c297c4/68346670772.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011624.bin
96ff8b6616e060bcec5cb64e2abc42fcc22926e9863bdf3a870cc16ddd78177d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11624 6444 bytes
font_01_sfnt_off000125e9.bin
95b7ef89d631f96ead6b7d68a9bb78f1e0b8a6f48f5f7f077fed0e4ad3968313		 pdf-font-stream PDF embedded font (sfnt) at offset 0x125E9 3692 bytes
font_02_sfnt_off0001333e.bin
29038fef15fb3a086141e2f139a24f369eb71e25f5e88d564893e87849462fcd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1333E 5460 bytes
font_03_sfnt_off000145a5.bin
e45cb6392effe6e57f222cdb40ec6b9b7e55299164b81a4b28e0ebb8e7a2e98e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x145A5 1640 bytes
font_04_sfnt_off00014de3.bin
bb6a2ed27dfd4a13e006df4121e9b1a6a4554431ccbf3660a3815926071a7ada		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14DE3 15496 bytes
font_05_sfnt_off00017d95.bin
cbcec9a010d9b971295212b3f2522532a6ba4a0cb4ba01461d4edabf69ef6ab7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17D95 16272 bytes
font_06_sfnt_off0001935e.bin
c500f3adbf8f2ec2f0c6e094baa630b41adbe1bce0e8a51a39f020d6923f7c5b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1935E 3640 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.