Malicious PDF — malware analysis report

Static analysis result for SHA-256 8c85c3c2278ce06a…

MALICIOUS

PDF

351.8 KB Created: 2021-03-10 04:52:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: 2e7227c08266b707b265bca96729b2be SHA-1: bb67a66b5579298d70d647f8b6fddae968f01548 SHA-256: 8c85c3c2278ce06a4391210d012428240bb6bd10c1712efc3b3b977f4c0cdc61
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL, identified as malicious by ClamAV and ML classifiers. The document body, though heavily obfuscated, suggests it is attempting to impersonate a financial report ('Amana takaful plc annual report 2016') to trick users into visiting the malicious URL. The presence of PDF-specific heuristics further supports its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9140

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/123?utm_term=amana+takaful+plc+annual+report+2016 PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4366980/normal_5fd07be5165d4.pdfIn PDF document text
    • http://lipefidakidu.22web.org/breve_resumen_del_libro_el_nombre_de_la_rosa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4371003/normal_5fd9f25141a39.pdfIn PDF document text
    • http://witaxiwudit.iblogger.org/how_to_use_resistance_bands_for_chest_and_arms.pdfIn PDF document text
    • http://loleveze.iblogger.org/cul_es_el_nombre_del_autor_del_libro_lazarillo_de_tormes.pdfIn PDF document text
    • http://zinusukimo.iblogger.org/affine_and_euclidean_geometry.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388272/normal_60442259e58f4.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/565df7c5-ecb4-42e2-98cd-f71aaa6e89e7/what_oil_does_a_2014_subaru_impreza_take.pdfIn PDF document text
    • https://76c9fb28-c10e-4950-85be-37de24a2ede8.filesusr.com/ugd/fa32a6_caa5c46c663945139f5b95b7bba9b875.pdf?index=trueIn PDF document text
    • http://sotexazonilot.rf.gd/46055617380.pdfIn PDF document text
    • https://b2f02272-107b-4032-aafc-54cdd6265a16.filesusr.com/ugd/6cf392_49f43a6998a8470e98454368d4287336.pdf?index=trueIn PDF document text
    • https://9764c975-acb6-4bd5-a3ff-b1f4624bc9bc.filesusr.com/ugd/5bcb7b_276f33794c87452bb762d89544ad44f2.pdf?index=trueIn PDF document text
    • https://dfa52777-3edb-460f-9b14-ca5101cd4ecc.filesusr.com/ugd/5360f8_f48d679eb0684fe0877cee7067e85922.pdf?index=trueIn PDF document text
    • https://790985df-dfec-4a08-b509-00f37668cf87.filesusr.com/ugd/a421e3_574453924e93428e929421b6340b0b38.pdf?index=trueIn PDF document text
    • http://bavodokebak.rf.gd/creating_nice_tables_in_word.pdfIn PDF document text
    • https://d09251a9-b09e-4077-8ccb-24037f005f7b.filesusr.com/ugd/a6ce17_be83c72989094d4b9828b7998ed7b299.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/e61fd825-fb9a-470a-b092-6ea066baf463/omega_juicer_customer_service_canada.pdfIn PDF document text
    • http://tefadipa.epizy.com/xubakajilanudagejanumexuj.pdfIn PDF document text
    • http://nekegax.epizy.com/basonetuxifuv.pdfIn PDF document text
    • https://f74ea38a-ab8d-49a0-8d31-9a1d7ce64423.filesusr.com/ugd/5ceade_7ef8407758814ae6834b10fa676fea7a.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/75b435bf-a393-45e3-bdd5-35798bf31876/dyson_cinetic_big_ball_canister_vacuum_reviews.pdfIn PDF document text
    • https://abbf68a8-5b21-4996-91be-11266bd273ed.filesusr.com/ugd/9374a7_7f2bfdf3783447b1b55a51cbf426a084.pdf?index=trueIn PDF document text
    • https://167c8e7b-8160-49a2-a88e-f26749d647c8.filesusr.com/ugd/1ad47d_f7162d546ae64148867649ee2a9cb685.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0004c1da.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4C1DA 41532 bytes
SHA-256: 358061da734ef9ef9a52af3332ce5454c8d42430330d8ad1875d05b7af14c578
font_01_sfnt_off000530ec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x530EC 5516 bytes
SHA-256: 14b5136bb40b3ac4479837a1ccd602436435c00bac65a37413b72b9075142d30
font_02_sfnt_off000543a2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x543A2 13116 bytes
SHA-256: 982441acf4dc8dd12579e1280d145a1c537901f721be658b74aed821f5cb3e17

Open this report in the interactive analyzer, or submit your own file for analysis.