Malicious PDF — malware analysis report

Static analysis result for SHA-256 8c8a0eb4298e0e95…

MALICIOUS

PDF

79.2 KB Created: 2021-04-26 18:02:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a3b250de1853ef92cfc64997a05ff118 SHA-1: 70aa6fab1bb6bbf06e177699f1ce8f2ce45f7fb8 SHA-256: 8c8a0eb4298e0e95430d80a540ef3a67b5ca0a5b7537f1c007a288be582f5a18
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. It contains an external URI pointing to a suspicious domain, likely intended to serve a malicious payload or redirect the user to a phishing site. The document body, though heavily obfuscated, contains text related to a 'Matlab tutorial pdf free download', indicating a social engineering lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9961

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=matlab+tutorial+pdf+free+download
    • https://static.s123-cdn-static.com/uploads/4426263/normal_5ffb60b5b3c07.pdf
    • https://cdn-cms.f-static.net/uploads/4410462/normal_60215f98d9a6b.pdf
    • http://air-calm2.club/lateral_thinking_puzzlesn5g4j.pdf
    • http://menformula.xyz/civilization_and_its_discontents_freud_sparknotesj2m5g.pdf
    • http://bred-enligne.com/what_molecular_shapes_are_polarrx99i.pdf
    • https://static.s123-cdn-static.com/uploads/4413735/normal_600300c0d3af4.pdf
    • https://static.s123-cdn-static.com/uploads/4476420/normal_5fced4c13c55d.pdf
    • http://begemotiks.space/guxunevetigufigd7d6q.pdf
    • https://cdn-cms.f-static.net/uploads/4405181/normal_602891675ce71.pdf
    • http://songkfrk.site/para_que_sirve_jengibre_y_curcumaeml0b.pdf
    • https://cdn-cms.f-static.net/uploads/4482424/normal_6013ca7612376.pdf
    • http://alifan.store/sony_bdp_s570_manualol2lz.pdf
    • http://creditreportusa.info/acog_cervical_cancer_screening_guidelines_20161kcxz.pdf
    • http://bcpzonasegura10beta-viabcp.com/jugapajiwesqppc.pdf
    • http://boomua.site/taxapetisabomosgtgrq.pdf
    • http://crispyset.online/how_is_biogenic_methane_formed3m2na.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/xonaxevetaf/laravel_vue_number_format.pdf
    • https://s3.amazonaws.com/leteraxewe/what_kind_of_oil_does_a_2011_honda_odyssey_take.pdf
    • https://s3.amazonaws.com/jarirotexab/36571717530.pdf
    • https://s3.amazonaws.com/midizaxopazeji/70643939871.pdf
    • https://s3.amazonaws.com/rumezo/jotupa.pdf
    • https://s3.amazonaws.com/kodipopujufipig/indian_parliamentary_procedure.pdf
    • https://s3.amazonaws.com/kosipefojaw/animated_movies_2016_free.pdf
    • https://s3.amazonaws.com/fuzafuzeruwit/fomazebivipafomuparusako.pdf
    • https://s3.amazonaws.com/pasawe/top_wilderness_survival_skills.pdf
    • https://s3.amazonaws.com/memobofilenabon/how_to_make_my_bluetooth_mouse_discoverable.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f7d9.bin
e3dedee584a8bba413b9497642cd4c6ef9615c7368a50659b199fda3117ae524		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF7D9 5096 bytes
font_01_sfnt_off00010952.bin
0ad0b1f8a921e392e514cde3b862012d85bdd9de5ecf94f12076e0e4b8fcdd3b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10952 10944 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.