Malicious PDF — malware analysis report

Static analysis result for SHA-256 8f49a8e3b7b5d6e0…

MALICIOUS

PDF

93.7 KB Created: 2021-07-05 06:36:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 729ac22ed7dfd665d871281d748624b3 SHA-1: 6a01337bcd25302781b64ab06377dd556d64f22f SHA-256: 8f49a8e3b7b5d6e042052c79c40d4521df77c80e5755797fd5ab66167dbef48e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, with heuristics indicating the presence of embedded URLs. While the document body is unreadable, the embedded URLs suggest a phishing or malware distribution attempt. No scripts were extracted, limiting the ability to determine the exact execution flow.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9876

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://apexforestservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a208c288873---kijovejona.pdf
    • https://agatanorek.com/files/file/56633634266.pdf
    • http://www.majorisinvestimentos.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16070817431fab---61440934621.pdf
    • http://verduciautodemolizioni.it/userfiles/file/8203636430.pdf
    • http://philippinesroadshow.com/wp-content/plugins/super-forms/uploads/php/files/3d57ad27fb1d459907899f2e69094fd8/fikogovemesixoguwejej.pdf
    • http://casaperferiesantamariagoretti.com/writable/public/userfiles/file/xopujopepipewurero.pdf
    • http://www.olympussverige.se/wp-content/plugins/super-forms/uploads/php/files/2b01efa7psaiksko2dg7um6tte/limixoj.pdf
    • http://thm-holding.ru/wp-content/plugins/super-forms/uploads/php/files/c2b80608da1928f8359dca4374964443/doruvavujalamemizu.pdf
    • http://broorybulldogs.com/clients/33993/File/vubikomafalabuzuvixeri.pdf
    • http://www.musicmaestrodiscos.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1606cac770ebb7---nuvaxusupedivuviluzopu.pdf
    • https://seataclightingalaska.com/wp-content/plugins/super-forms/uploads/php/files/e15eecf2c6d0cd916cee80b4ed93c6aa/89452725522.pdf
    • https://daleplumbinginc.com/wp-content/plugins/super-forms/uploads/php/files/d1e7c18b6833405049d324dfd59cb015/89217687994.pdf
    • http://3handseg.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606ee0015620f---fijowirubip.pdf
    • http://amandatravel.com/userfiles/file/5399040054.pdf
    • https://www.olympusnorge.no/wp-content/plugins/super-forms/uploads/php/files/3mtj32bpom3so8po6281usjp5k/nusewunorudezikemunili.pdf
    • http://asset-books.com/userfiles/file/midug.pdf
    • https://www.kalirich.com/wp-content/plugins/super-forms/uploads/php/files/uk88094p7o2j3g6p59a139dgi6/61574776376.pdf
    • http://fine-cottage.ru/userfiles/file/kisixawazibaludoraro.pdf
    • https://aucordechasse.fr/vosImages/91754608396.pdf
    • https://www.lenoir-elec.com/wp-content/plugins/super-forms/uploads/php/files/4uenlqpuuvu908bvrneomgs1lu/51097421562.pdf
    • https://koetec.com/home/~ptow/public_html/ckfinder/userfiles/files/48912710036.pdf
    • http://vo23.ru/upload/file/91640772388.pdf
    • https://g-ortho.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16085afcca223d---5841604386.pdf
    • https://feedproxy.google.com/~r/Uplcv/~3/Om9ozkHLxGw/uplcv?utm_term=auxiliary+verb+to+do
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010e5f.bin
e5f92198db3c3438187c5247f6514eebb9bf2dbc1c29502ed2b04bcb2a4c9459		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E5F 10472 bytes
font_01_sfnt_off00012650.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12650 16792 bytes
font_02_sfnt_off00013e62.bin
d6f3ed8fa3105992982be72f46ececd501ad5583952f0956a62e359bafcb0a17		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13E62 19172 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.