Malicious PDF — malware analysis report

Static analysis result for SHA-256 8f6c06f507093569…

MALICIOUS

PDF

77.9 KB Created: 2021-04-07 01:16:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7a660941f3f6dbf32f63a981be997e34 SHA-1: 7f9080ce82f832bc0d91ce243fcabad049c08678 SHA-256: 8f6c06f50709356929e1c4e6e16195d80b546eedc2b77c00eaaf5be950be7cd3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URI pointing to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also flagged this PDF with high confidence. The document body, though heavily obfuscated, suggests a lure related to 'Acuerdo de paris pdf', likely intended to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/award?keyword=acuerdo+de+paris+pdf
    • https://cdn.sqhk.co/juwafajem/jigrlhg/98429706587.pdf
    • https://cdn.sqhk.co/vukupamita/gyigDjd/barbershop_2_back_in_business_movie_2004.pdf
    • https://cdn.sqhk.co/mosizuwowux/cieo7QK/badri_ki_dulhania_full_movie_video.pdf
    • https://cdn.sqhk.co/disumuneriva/m6Bhegd/doom_slayer_helmet_for_sale.pdf
    • https://cdn-cms.f-static.net/uploads/4453907/normal_60542479670a4.pdf
    • https://cdn-cms.f-static.net/uploads/4424645/normal_604421b1d13f9.pdf
    • https://static.s123-cdn-static.com/uploads/4374520/normal_5fe23f4d7956f.pdf
    • https://cdn.sqhk.co/zogobadakedu/ZuiaEhi/14450579603.pdf
    • https://cdn.sqhk.co/mawejoxejobe/bdEjbpV/woodturning_supplies_hampshire_uk.pdf
    • https://static.s123-cdn-static.com/uploads/4444377/normal_60013f4367039.pdf
    • https://cdn.sqhk.co/rutunidosaw/bjdShc9/zefegafoba.pdf
    • https://cdn.sqhk.co/vakanaju/ifMgdhc/download_cooking_joy_2_mod.pdf
    • https://cdn.sqhk.co/lesasafo/gyEhbii/talking_tom_and_ben_news_v2_game.pdf
    • https://cdn.sqhk.co/sevijeruba/Jjfhbhi/bemitegimixaxedekiniwiva.pdf
    • https://cdn-cms.f-static.net/uploads/4392195/normal_605d88e666c73.pdf
    • https://cdn.sqhk.co/bevurokakug/jhf5he7/freeze_your_credit_for_free.pdf
    • https://cdn.sqhk.co/rawatajizefu/gji1A1H/shoujo_city_anime_game_premium_apk.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/retobifulipo/21642160427.pdf
    • https://s3.amazonaws.com/tobaziw/why_leaders_eat_last_simon_sinek.pdf
    • https://s3.amazonaws.com/tugabijenovili/caremark_medicare_part_d_pa_form.pdf
    • https://s3.amazonaws.com/fejenijovekozu/55626829305.pdf
    • https://s3.amazonaws.com/bisute/32661385091.pdf
    • https://s3.amazonaws.com/bibejovixapis/alaska_driver_licence_requirements.pdf
    • https://s3.amazonaws.com/jewizopukuni/cf_auto_root_j111f.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f03e.bin
2356a0b1ec7bb0061da1cd5bcb8f8b74ed11996bd310351e6409dd4beb8c54d2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF03E 5104 bytes
font_01_sfnt_off000101ac.bin
dc138114007ea384d544cb32b9cb24f0831df4f9d9e907f67824f2ad8733a918		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101AC 11868 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.