Malicious PDF — malware analysis report

Static analysis result for SHA-256 8e3dde0160ecbd93…

MALICIOUS

PDF

89.2 KB Created: 2021-03-20 11:54:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a5a1809e57de671de3cca734ba10a8f1 SHA-1: 2ce0056959516b67fb887bbd612b673ce9cd58a0 SHA-256: 8e3dde0160ecbd935918564df405dda65adfe55936300f5af55d584a187a2274
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URL pointing to a suspicious domain, likely intended to deliver a phishing lure or further malicious content. The document body, though heavily obfuscated, suggests a pretext related to an 'ESI phone system manual'. No scripts were extracted, but the presence of an external URI and the overall detection profile strongly indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wix?keyword=esi+phone+system+manual
    • https://cdn-cms.f-static.net/uploads/4495841/normal_5fd61bd652d16.pdf
    • https://static.s123-cdn-static.com/uploads/4405185/normal_5fcff31b601b9.pdf
    • https://cdn-cms.f-static.net/uploads/4366009/normal_6014209abcb20.pdf
    • https://cdn-cms.f-static.net/uploads/4366044/normal_6020a72ddffac.pdf
    • https://static.s123-cdn-static.com/uploads/4413019/normal_5fc8c6f884b3b.pdf
    • https://cdn-cms.f-static.net/uploads/4424645/normal_600fbee44d773.pdf
    • https://cdn-cms.f-static.net/uploads/4426279/normal_6033f811396e2.pdf
    • https://cdn-cms.f-static.net/uploads/4393762/normal_601143d3c7dd1.pdf
    • https://cdn-cms.f-static.net/uploads/4386829/normal_603e6ade09017.pdf
    • https://cdn-cms.f-static.net/uploads/4478928/normal_604d97fe13bc0.pdf
    • https://static.s123-cdn-static.com/uploads/4366382/normal_5fe3a007c68ce.pdf
    • https://cdn-cms.f-static.net/uploads/4385207/normal_60172ee985293.pdf
    • https://cdn-cms.f-static.net/uploads/4414672/normal_5fd78d7be9b9a.pdf
    • https://static.s123-cdn-static.com/uploads/4492593/normal_5fc9b9ddefab6.pdf
    • https://cdn-cms.f-static.net/uploads/4446029/normal_603ae9f2d7fff.pdf
    • https://cdn-cms.f-static.net/uploads/4478123/normal_602e4828034e6.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/mexesazaxasa/computer_programing_schools_near_me.pdf
    • https://s3.amazonaws.com/nasitevu/81879318289.pdf
    • https://s3.amazonaws.com/fekaduvopigab/66135773839.pdf
    • https://s3.amazonaws.com/risisipajole/armored_warfare_pc.pdf
    • https://s3.amazonaws.com/ponivotigegepub/aviation_weather_metar_description.pdf
    • https://s3.amazonaws.com/xilasisefi/xewetanim.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001216b.bin
1ae3dc6d673e97f52ef321631ceed38f0fce270ef747b05f17d9af66d58be16f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1216B 5020 bytes
font_01_sfnt_off00013262.bin
9e9a6a0e15fb1bceb06e6636972a4d838d30b7d6b205f8e433ba66335ee06bc1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13262 10996 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.