Malicious PDF — malware analysis report

Static analysis result for SHA-256 8e4dbe4b5bc37f6b…

MALICIOUS

PDF

66.0 KB Created: 2020-12-23 20:15:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 011f9a0f22dec5335c9ab73e6bb8cb80 SHA-1: db4668ad72e7fcb0bf31d5d4d950bcf6638c2919 SHA-256: 8e4dbe4b5bc37f6b6c1c76788ec276e01a46bd54284105b4c7f53c19f63159dd
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing attempt. It contains an embedded URL that directs users to a suspicious domain, likely to deliver a secondary payload or phish for credentials. No scripts were extracted, but the PDF structure and embedded URI suggest a social engineering lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/aws?utm_term=maranatha+almond+butter+nutritional+information PDF link annotation
    • https://cdn.sqhk.co/fipexuwebo/jeXJjdq/big_circle_color_contact_lenses.pdfIn PDF document text
    • https://cdn.sqhk.co/tadawatimi/atWijhh/15255832176.pdfIn PDF document text
    • https://cdn.sqhk.co/wememiguw/haHjfKY/snakes_and_ladders_online_3_players.pdfIn PDF document text
    • https://cdn.sqhk.co/nutakurij/IhaF9zM/heroines_fantasy_wiki.pdfIn PDF document text
    • https://cdn.sqhk.co/fabupiguboxa/gg2igGk/lefawemisoxumegixenos.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/b5f2a4c6-a692-4806-9f6c-e7a16ec2318d/evony_troop_glitch_2017.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dda9d0db-e743-49d9-8ccc-0461ae95ac73/epson_rx595_user_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/27694c2a-bd9c-4d32-9984-8c5e9ebf1dcc/gudasepifizejamuditodefuv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bca04b94-3ecf-4769-9e96-9ab70f7890d6/chapter_6_the_periodic_table_answer_key.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9521d962-5568-415e-846c-60f564f137a6/what_is_cnn.pdfIn PDF document text
    • https://s3.amazonaws.com/vipinib/peptic_ulcer_treatment_nice_guidelines.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/81500339-3a0f-4c23-8850-1ad180cc4bf9/lixegezim.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/25d8a7d0-bbf6-4fb2-b555-92788d88bdc8/bozovasizugo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/361e28d2-9c20-4f15-8d4b-c437d1f26260/govikoborokelevawolunid.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b747.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB747 4996 bytes
SHA-256: a56137eb5efc97269fd398d3293f930b46240e3373e11ca3eb01df4a41cb19b2
font_01_sfnt_off0000c810.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC810 10828 bytes
SHA-256: c9082db72933645cb04c2f51cb96d417b0048a57ac4b7bcab6363acb703cbc8f
font_02_sfnt_off0000ed0c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED0C 4324 bytes
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e

Open this report in the interactive analyzer, or submit your own file for analysis.