Malicious PDF — malware analysis report

Static analysis result for SHA-256 8fa6f04ab63b15d5…

MALICIOUS

PDF

85.1 KB Created: 2021-03-06 03:30:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: ef91c82f5f62fa80a58bc4398adc71f4 SHA-1: a14d8817cf80e2c3b2bbb8f6c2068e2bd4b3e047 SHA-256: 8fa6f04ab63b15d534eb920fcc5c6147942117ef655952f9490ae3bb8a95a15f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ML classifiers and ClamAV. It contains an embedded URL that mimics a search result for a technical document, likely intended to trick the user into visiting a phishing or malware distribution site. No scripts were extracted, but the PDF structure and embedded URI are strong indicators of a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/award?keyword=halliday+resnick+walker+11th+edition+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4476127/normal_6031beda1493d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471109/normal_601a406f5b72f.pdfIn PDF document text
    • https://cdn.sqhk.co/soleximu/RjhTswN/iphone_5s_32gb_rtv_euro_agd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481065/normal_602b9167440d1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4407062/normal_6006514c20c69.pdfIn PDF document text
    • https://cdn.sqhk.co/sinonari/igiwOKB/epic_games_login_activate.pdfIn PDF document text
    • https://cdn.sqhk.co/vuritukupus/ijthbge/kanto_pokemon_quiz.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4480582/normal_5ff54deb20c3b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416150/normal_6026e0d964ca3.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4384159/normal_5fdd914b16bdc.pdfIn PDF document text
    • https://cdn.sqhk.co/febowozefu/gZxiahf/simple_singly_linked_list_program_in_c.pdfIn PDF document text
    • https://cdn.sqhk.co/kedilexele/Ukz7z4C/roblox_gift_card_pins_2020.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451023/normal_600c248cc512c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/b3b5cefa-5734-4f75-b86c-895d483b4296/77023651033.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b506d2b7-08a9-49d4-8d7f-72aa1d0adcdd/how_to_pause_google_search_history.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/88a661b2-bb1c-4a11-95c5-6dae571db4ec/big_blue_party_x_speaker_brookstone.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/73cf7435-5b27-48d0-8c02-0060ce9428a4/interview_questions_for_teachers_from_students.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c0b8cb0a-d011-4412-9d10-0d1a6bef6ab0/17416726428.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0b85ebd6-c2c3-4875-aaf1-325ef470fd4a/is_the_canon_powershot_sx420_a_good_camera.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3d8aa37d-f4f6-4594-8442-3aeed653184e/18033886768.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c006ceef-a7cc-400e-b7c1-574f29ac4968/pejibe.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010353.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10353 5300 bytes
SHA-256: 50b4ae20ddbd86b769464c06808e487a93454d2715317d5798ba839143cc4441
font_01_sfnt_off00011563.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11563 10228 bytes
SHA-256: e3c784daf1cdaa3fea998a4f43b5810c25b158ee20515c750752c9d093026029
font_02_sfnt_off0001387b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1387B 4324 bytes
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3

Open this report in the interactive analyzer, or submit your own file for analysis.