Malicious PDF — malware analysis report

Static analysis result for SHA-256 8eb7a06191f4d2e1…

MALICIOUS

PDF

79.4 KB Created: 2021-05-15 10:40:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 451933030cd66275a7c613ec652dabc6 SHA-1: 48c55b0ff2fbacb1efc332eda64a8b6020279f6d SHA-256: 8eb7a06191f4d2e16f579dc9071d2e7f54a2159b6d91c693bdc97de64c8bf954
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains an embedded URL pointing to a suspicious domain, identified by heuristics and a machine learning classifier as malicious. ClamAV also detected it as Pdf.Phishing.Trojan. The presence of an external URI and the overall malicious classification strongly suggest a phishing or malware delivery attempt. No scripts were extracted, but the PDF structure itself facilitates the redirection to the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=what+age+is+the+hobbit+movie+appropriate+for PDF link annotation
    • https://mazekijaxok.weebly.com/uploads/1/3/1/4/131453602/5721904.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4369524/normal_5fef46c92e69a.pdfIn PDF document text
    • https://nipetetoxijekuj.weebly.com/uploads/1/3/4/7/134718304/870405.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4382412/normal_5fff6b5ff1b6e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4478148/normal_6054f13668840.pdfIn PDF document text
    • http://vaxisezawoged.scienceontheweb.net/marriage_certificate_application_form_in_marathi.pdfIn PDF document text
    • http://govajidenemases.22web.org/tesanovupedimabakowe.pdfIn PDF document text
    • http://mogisut.medianewsonline.com/blastocystis_hominis_treatment.pdfIn PDF document text
    • http://tepugorotewole.medianewsonline.com/presonus_firepod_firewire_interface.pdfIn PDF document text
    • http://xokezuwadem.mygamesonline.org/rokizubaku.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/nefomojuwet/bachelor_degree_in_business_information_systems.pdfIn PDF document text
    • https://s3.amazonaws.com/rujabepifar/31185027832.pdfIn PDF document text
    • http://bixakisa.epizy.com/61727358132.pdfIn PDF document text
    • http://madepug.rf.gd/mokexeboxiriloso.pdfIn PDF document text
    • https://s3.amazonaws.com/busutafitufe/euchre_score_sheets_for_16_players.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9d1a7b1c-b4e6-4d17-ae33-aca412531a0f/sennheiser_rs_120_wireless_headphones.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/73a168b4-037a-401b-b594-5026c2650729/imagen_de_sistema_endocrino_con_sus_partes.pdfIn PDF document text
    • https://s3.amazonaws.com/xamibudasagas/jiwive.pdfIn PDF document text
    • http://wajufuful.rf.gd/data_mining_software.pdfIn PDF document text
    • http://mekasesajiw.onlinewebshop.net/45700934557.pdfIn PDF document text
    • https://s3.amazonaws.com/lazolu/aew_dynamite_bleacher_report_grade.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f79f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF79F 5496 bytes
SHA-256: 0a26e4b7195c2e370a240105fd7d57c1d70032772fb27b14cc05a715d2de8e3f
font_01_sfnt_off00010a38.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A38 11092 bytes
SHA-256: 4f8e4a6b9d4b8b3517a7fbf1ff69763d32714ab6c6150ec613a9b920f53978eb

Open this report in the interactive analyzer, or submit your own file for analysis.