Malicious PDF — malware analysis report

Static analysis result for SHA-256 8a5927ac016eadce…

MALICIOUS

PDF

71.4 KB Created: 2021-04-29 22:55:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5eeaa1b7657276bd03afe2cf579e9fa6 SHA-1: dca3c8735f2c41ba16ce0cc728ea557f3d5c6269 SHA-256: 8a5927ac016eadcedc4ad00bf6a727f4ddee08419bf18c6a53b52df833ddc2b2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The PDF contains embedded URLs that point to other PDF files hosted on compromised websites, suggesting a phishing or malware distribution scheme. The presence of these external links and the overall detection score strongly suggest this PDF is part of a larger attack chain, likely involving social engineering to trick users into downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.x454.com/wp-content/plugins/super-forms/uploads/php/files/c3v0o3441qe9ptn3iimj4piks1/dogekotujizekonu.pdf
    • https://razdolle.by/wp-content/plugins/super-forms/uploads/php/files/049d0r2jbb37t68h8vqrtcsii2/57332975812.pdf
    • https://sportli.co.il/wp-content/plugins/formcraft/file-upload/server/content/files/16087a04753989---76828558255.pdf
    • https://alsterparkett.de/wp-content/plugins/super-forms/uploads/php/files/smr8ms0kiop9oij0i22qhtbvds/1808152342.pdf
    • http://plusbateria.com/wp-content/plugins/formcraft/file-upload/server/content/files/160796bd389c42---gevapevivabuvemuza.pdf
    • https://rosemonttherapy.health/wp-content/plugins/super-forms/uploads/php/files/e1rmffoigjguh2ql9939kplb28/28054312794.pdf
    • https://beaufortbond.com/wp-content/plugins/super-forms/uploads/php/files/b0504728c46d2027db257c245806705f/zawuvokogixita.pdf
    • http://www.julitolaschools.com/wp-content/plugins/formcraft/file-upload/server/content/files/16086b0d44c88d---48995333999.pdf
    • http://lisahyatthealth.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607fd525a3ade---gakani.pdf
    • http://inlikeflintlogistics.com/wp-content/plugins/formcraft/file-upload/server/content/files/16086942ad8fb1---fezejaxowomarizenilowovud.pdf
    • http://milcontabil.com.br/wp-content/plugins/super-forms/uploads/php/files/79blht0kv220fqtse18uh3mnn5/76358589749.pdf
    • https://smarttactic.ro/wp-content/plugins/formcraft/file-upload/server/content/files/16080a6a70e75a---mojuvus.pdf
    • http://www.dnevi-sekretarjev.eu/wp-content/plugins/formcraft/file-upload/server/content/files/1607d94880414a---mikekitopezarali.pdf
    • http://paymentsbusiness.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1607a0e9f9ab26---31857171327.pdf
    • https://daleplumbinginc.com/wp-content/plugins/super-forms/uploads/php/files/7e8feb4288877dd367eaa71a357ae88b/34179373747.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/skout/mBVl/~3/BkSY9tpko7c/uplcv?utm_term=uganda+national+census+report+2014
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d558.bin
0918b94760ae1f758043772a5f0a8a929366010494ba306d543432018b931305		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD558 5648 bytes
font_01_sfnt_off0000e8b1.bin
bf7f76a1832fea2c97008b9e84ea784e86d0f6c719bb83177577c8d381acc624		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE8B1 11568 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.