Malicious PDF — malware analysis report

Static analysis result for SHA-256 88d14087011817b1…

MALICIOUS

PDF

92.9 KB Created: 2021-02-10 10:19:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: b8aac9c0435341b8f4a16acba0a494a8 SHA-1: 430e8660aa5f7797313854aa6b6c36e211699362 SHA-256: 88d14087011817b1bbbc710bc53ab888a9aaa5a9e5c4c0de7ac11af3d08bfe07
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with heuristics indicating the presence of external URIs and embedded URLs. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf and includes a URL that appears to be a search query. This suggests the document is designed to trick the user into clicking a link that leads to a malicious site, potentially for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wb?keyword=aliens%20vs%20predator%202004%20movie PDF link annotation
    • https://cdn.sqhk.co/nixivezez/geigbLi/93843003673.pdfIn PDF document text
    • https://cdn.sqhk.co/dofubetu/fNezjgL/ponigubesanile.pdfIn PDF document text
    • https://cdn.sqhk.co/wevexifimur/YgeQhj6/airfield_lighting_control_and_monitoring_system.pdfIn PDF document text
    • http://obzorov.site/fusezafvph2l.pdfIn PDF document text
    • https://cdn.sqhk.co/jamolipa/rja0ghB/absolute_rc_heli_sim_unlimited_money.pdfIn PDF document text
    • https://cdn.sqhk.co/koxopumo/heBmsWY/34033392772.pdfIn PDF document text
    • https://cdn.sqhk.co/gukisafuw/7ialjaE/beard_styles_for_round_face_male.pdfIn PDF document text
    • https://cdn.sqhk.co/kanereneb/ifhdmO4/bejapisarekito.pdfIn PDF document text
    • https://cdn.sqhk.co/xaranoraf/jdhahis/punuxapupoxitagaw.pdfIn PDF document text
    • https://cdn.sqhk.co/wuxaguzifep/5xsS7gi/xunebij.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/fajetufekejo/cadillac_srx_2004_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/rodakarugupoko/90858811618.pdfIn PDF document text
    • https://s3.amazonaws.com/divelikubapiwaj/17079152313.pdfIn PDF document text
    • https://s3.amazonaws.com/xojafemori/matrices_problems_and_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/geraromu/bajrang_dal_dj_remix_naa_songs.pdfIn PDF document text
    • https://s3.amazonaws.com/muxozuvalubi/lafuxumuxaliliduloduv.pdfIn PDF document text
    • https://s3.amazonaws.com/pokixovuxik/sathuranga_vettai_movie_songs.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012dd2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12DD2 5516 bytes
SHA-256: 11cb85953cba1d23d36fa805b1c9fc9ea697c0a4ade9dbd35048cdabe1a8d12a
font_01_sfnt_off0001408a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1408A 11156 bytes
SHA-256: 84ed7831ec21e66bf64761f9e9a1584d885236fa305e2f73475c62d107660886

Open this report in the interactive analyzer, or submit your own file for analysis.