Malicious PDF — malware analysis report

Static analysis result for SHA-256 8a09b95a12d5ca11…

MALICIOUS

PDF

78.8 KB Created: 2021-05-04 12:43:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 85259d25a9f769fe79590ade88e3079b SHA-1: d181b91cbc818a1c41aec0ca893f7627bdde44dc SHA-256: 8a09b95a12d5ca11c6b1371fa2312c7f1fa2f9173270d0ecd7dea9f9efe274c2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic indicating an external URI, which points to a suspicious domain. The ML classifier and ClamAV detection strongly suggest malicious intent, likely phishing or malware distribution. The embedded URL is the primary indicator of compromise, suggesting the document is a lure to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=how+to+read+comics+for+free+on+android
    • https://cdn-cms.f-static.net/uploads/4454299/normal_6060944be0155.pdf
    • https://cdn-cms.f-static.net/uploads/4496816/normal_601ef49ce669f.pdf
    • https://kumazapo.weebly.com/uploads/1/3/2/7/132710765/09b6cb19da.pdf
    • https://static.s123-cdn-static.com/uploads/4413236/normal_5fc91bf33fc86.pdf
    • https://static.s123-cdn-static.com/uploads/4487647/normal_60047e564700f.pdf
    • https://gumewutudeg.weebly.com/uploads/1/3/0/8/130813982/2773590.pdf
    • http://roserubusigiwij.mywebcommunity.org/finger_phonics_big_book.pdf
    • http://draiwenstore.online/zepubi6k8xd.pdf
    • https://static.s123-cdn-static.com/uploads/4480755/normal_5fc859bacc161.pdf
    • https://pagejenaxupiwig.weebly.com/uploads/1/3/4/3/134383440/3d5fc068a73d.pdf
    • http://kesisofawa.mygamesonline.org/rarivawoxemozufidup.pdf
    • https://zuxevuzefadum.weebly.com/uploads/1/3/0/7/130775429/mekilureme.pdf
    • https://lemefiware.weebly.com/uploads/1/3/4/0/134017231/5ec78.pdf
    • http://leqqurint.online/nikon_coolpix_l22jwobz.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/nowonovege/buffalo_airstation_firmware.pdf
    • https://s3.amazonaws.com/sulasatevirexo/can_you_use_itunes_songs_on_android.pdf
    • http://masegopadi.epizy.com/sinhala_children_s_songs_mp4.pdf
    • http://gujimosodaza.myartsonline.com/who_is_considered_immediate_family_for_bereavement_leave_walmart.pdf
    • https://s3.amazonaws.com/kakef/vorenakepepetagoxoj.pdf
    • https://s3.amazonaws.com/forupokisip/challenge_film_video_song.pdf
    • http://woxiriselof.epizy.com/vewumaxoniwipufedut.pdf
    • http://nasakitubaribud.rf.gd/62627069680.pdf
    • http://kavuduvolilazod.myartsonline.com/elevating_learning_and_development.pdf
    • https://s3.amazonaws.com/kugelilizibuwum/construct_the_probability_distribution_function.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4df.bin
86142d0720dc93bd268632bc966e6b71e125a11687045c30bc866ac6d9250f7a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4DF 5188 bytes
font_01_sfnt_off00010680.bin
a9958c5c0ec9868226385dd1447f968a5d74b13c01036ef2238be9a4ff94e376		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10680 11448 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.