Malicious PDF — malware analysis report

Static analysis result for SHA-256 8f4a81d12fa3a7f8…

MALICIOUS

PDF

86.1 KB Created: 2021-03-24 10:27:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 0c0fd64a495fb47f361fd89adfedd407 SHA-1: 6fc74c4dae89d182e157648e4fe92ad9fc8f5ae6 SHA-256: 8f4a81d12fa3a7f8d702db0c03d99aea245e3146265f4933802b65d14222ca1e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing campaign. The document body, though heavily obfuscated, suggests a lure related to an 'award'. No scripts were extracted, but the presence of external URIs indicates an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/award?keyword=baneful+magick+pdf PDF link annotation
    • http://wonder-ita.fun/vugenhvraj.pdfIn PDF document text
    • http://mandarins.space/pacific_energy_fireplace_insert_partswzv9y.pdfIn PDF document text
    • http://xepuxesadara.mypressonline.com/essential_statistical_inference.pdfIn PDF document text
    • http://vuzuwul.getenjoyment.net/samsung_tv_ir_sensor_not_working.pdfIn PDF document text
    • http://wejuzofibab.medianewsonline.com/what_is_david_goggins_doing_now.pdfIn PDF document text
    • http://teagreen.space/lisatavg2gfh.pdfIn PDF document text
    • http://runmasten.online/asp.net_vb_tutorial_for_beginners_with_examplesws30l.pdfIn PDF document text
    • http://xumupizaxuto.scienceontheweb.net/64031194956.pdfIn PDF document text
    • http://kutejovanog.getenjoyment.net/ipad_app_highlight_notes.pdfIn PDF document text
    • http://lowusonuraku.mygamesonline.org/rapebotoji.pdfIn PDF document text
    • http://teguruta.medianewsonline.com/assessment_for_learning_b._ed.pdfIn PDF document text
    • http://sakhavto.ru/dd_3.5_monster_encounter_generatorpjk6c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://a1d3e036-d9a1-4be1-9d2f-eedbb581cb22.filesusr.com/ugd/3ce946_5b65c263424a487aa2a4bb9e2c28b10f.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vetamedisoz/kuxomademiremowifazo.pdfIn PDF document text
    • https://s3.amazonaws.com/kumasala/free_jpg_white_background.pdfIn PDF document text
    • https://s3.amazonaws.com/dezajok/20768981599.pdfIn PDF document text
    • http://vidugozu.atwebpages.com/sagiwikelunufokesedawita.pdfIn PDF document text
    • https://s3.amazonaws.com/vinejivunitego/english_tagalog_translator_free_for_pc.pdfIn PDF document text
    • https://be08d7d4-326a-4801-be9d-4496af17a43b.filesusr.com/ugd/d31907_37f4a5f9b5b34f9c9d5dfffec03f5052.pdf?index=trueIn PDF document text
    • https://6c639bf1-704a-4500-b661-329758898742.filesusr.com/ugd/02d620_ad50a78e664045cb8063fa38d6cbc30c.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f146.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF146 5008 bytes
SHA-256: 1a636e7011bf6a8e573f667df596e2705f4e8b2c2fa8939334b9d759078aa61f
font_01_sfnt_off0001023b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1023B 10984 bytes
SHA-256: 5c00dcd782f3933d0d64df203caedf32cf9288c50da53a851f3532442d6aaf80
font_02_sfnt_off00012803.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12803 16168 bytes
SHA-256: e5458d7b6d82539349b17fc4713a17e1381d471255c72d9f8116b7c86e08c443
font_03_sfnt_off00013d08.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13D08 4324 bytes
SHA-256: 05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176

Open this report in the interactive analyzer, or submit your own file for analysis.