Malicious PDF — malware analysis report

Static analysis result for SHA-256 8a6d5226c087aa06…

MALICIOUS

PDF

71.6 KB Created: 2021-03-14 10:58:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 519aabd6ffdb86575d54db05c11baf13 SHA-1: d6bf8df64e5b8adee57821b5b797b6104d43c072 SHA-256: 8a6d5226c087aa060ca9337de431314472156fa5a460619fef5cd525fd7b921b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains embedded URLs and is flagged by ML classifiers and ClamAV as malicious, indicating a phishing or trojan distribution attempt. The document body, though heavily obfuscated, suggests a lure related to a 'mapa fisico america mudo pdf'. The primary malicious indicator is the external URI pointing to a suspicious domain, likely serving a malicious payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9956

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/123?utm_term=mapa+fisico+america+mudo+pdf
    • https://cdn.sqhk.co/purorelaz/ehivijB/save_the_president_game_free_online.pdf
    • http://loginenujivaj.iblogger.org/79466167649.pdf
    • https://cdn-cms.f-static.net/uploads/4458623/normal_602c332fa1c39.pdf
    • http://kovajexikimodu.iblogger.org/how_to_use_golds_gym_xrs_20.pdf
    • https://cdn.sqhk.co/zebimapajod/ijiSpgh/88880744974.pdf
    • https://cdn-cms.f-static.net/uploads/4367621/normal_603283d8c9699.pdf
    • https://cdn-cms.f-static.net/uploads/4418185/normal_602ef7776cca0.pdf
    • https://cdn.sqhk.co/zekafomaze/AEhjx2Z/download_game_farm_heroes_super_saga_mod_apk.pdf
    • https://cdn.sqhk.co/dipasupor/iFia3dD/cute_message_ringtone_for_iphone.pdf
    • http://refixewu.iblogger.org/maslow_s_hierarchy_of_needs_book.pdf
    • https://static.s123-cdn-static.com/uploads/4376125/normal_5fe2f270e0b72.pdf
    • https://cdn-cms.f-static.net/uploads/4420756/normal_6018b2b963c21.pdf
    • http://tojanulisito.iblogger.org/42745944279.pdf
    • https://cdn.sqhk.co/remimuroku/6jjhcZr/panaleboparumaduxitoge.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/fbd15105-5919-4922-add9-5e7781377b6f/seiko_chronograph_100m_watch_price_in_bangladesh.pdf
    • https://uploads.strikinglycdn.com/files/8c828d42-d5da-4d0b-b275-86e2cb85aa5f/kalowit.pdf
    • http://lizaxuru.rf.gd/49398583501.pdf
    • https://uploads.strikinglycdn.com/files/7bd83d9e-2fc5-4a0a-95dd-0680906530d9/88718427658.pdf
    • http://sazosubegus.epizy.com/nibotudutusininajowifus.pdf
    • https://uploads.strikinglycdn.com/files/b43e0b22-c021-42bc-834a-d4b3157329f6/88172268010.pdf
    • http://dufexisoji.rf.gd/honeywell_fan_limit_control_manual.pdf
    • http://bewefesa.epizy.com/definicion_de_epistemologia_segun_autores.pdf
    • http://dedetepejoxele.epizy.com/disapibudojegivakefigoz.pdf
    • http://luzegatujil.epizy.com/gidakukaruto.pdf
    • https://uploads.strikinglycdn.com/files/02a4e548-5f7d-49a7-b36c-b9a9d173a330/web_services_vs_microservices.pdf
    • http://xitimevekotumev.rf.gd/xukokalub.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cbd6.bin
5fbb4443e11709230c6bcafb4deb9fe1090d51235e4685afc6d7d7a3413f8b73		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCBD6 4968 bytes
font_01_sfnt_off0000dcb3.bin
083cadd10dfe42f134b6d1c3406636f130b736adeda9655aed44182084f459c7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDCB3 11016 bytes
font_02_sfnt_off000100b9.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100B9 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.