Malicious PDF — malware analysis report

Static analysis result for SHA-256 90faac206ef4748a…

MALICIOUS

PDF

83.4 KB Created: 2021-02-14 12:58:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: 057a4a218aeec41d0d2002153e7bf015 SHA-1: 2d47d421b4346dff1e8d6c90aa6cb6c5d62d7eaa SHA-256: 90faac206ef4748a280b30237d28776d4147821771f212a3e98895600ece23c5
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to online content, consistent with phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/123?utm_term=the+gender+game+bella+forrest+read+online PDF link annotation
    • http://romeita.fun/devawowufil0dkoi.pdfIn PDF document text
    • https://cdn.sqhk.co/sepagumal/cfhjlij/only_one_kanye_west_audio.pdfIn PDF document text
    • http://halfraire.xyz/context_clues_synonyms_and_antonyms_example35ae9.pdfIn PDF document text
    • http://de-bewertung-889562.icu/risoxoledorexoj8bq0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447276/normal_6028a4c6d1e26.pdfIn PDF document text
    • http://abreudesigns.com/28794213628ymnmh.pdfIn PDF document text
    • https://cdn.sqhk.co/wujakegu/dhm3jiz/nemobibanazepu.pdfIn PDF document text
    • https://cdn.sqhk.co/gebitasixa/SMggchh/lemepivan.pdfIn PDF document text
    • http://idealica-italy.site/los_atributos_de_dios_ipucazl7p.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421639/normal_5fd29db377d6d.pdfIn PDF document text
    • http://bnl-jobs.com/systems_analysis_and_design_in_a_changing_world_7th_edition_amazon7qvtf.pdfIn PDF document text
    • https://cdn.sqhk.co/daxegajok/YOHjg4j/pufudumepodiwenimarupexim.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/gekixadonuru/what_is_chomsky_normal_form.pdfIn PDF document text
    • https://s3.amazonaws.com/jevelel/73559526856.pdfIn PDF document text
    • https://s3.amazonaws.com/jukoxisojow/corporate_charter_approval_sheet_maryland.pdfIn PDF document text
    • https://s3.amazonaws.com/napoledunadigo/esercizi_analisi_logica_e_grammaticale.pdfIn PDF document text
    • https://s3.amazonaws.com/godewumazek/sefasotuwevixi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb09.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB09 5200 bytes
SHA-256: de56ff2df0c839d010d156563bce1dd05e7c3d0607909886b59be7ae7d34576c
font_01_sfnt_off00010c81.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10C81 11180 bytes
SHA-256: 895c87004662ecfb4fe50785401c2d62cb33a47cf85b30bb5541c70f506eb354
font_02_sfnt_off00013246.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13246 4324 bytes
SHA-256: 9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2

Open this report in the interactive analyzer, or submit your own file for analysis.