Malicious PDF — malware analysis report

Static analysis result for SHA-256 91def2149c2cc830…

MALICIOUS

PDF

76.7 KB Created: 2021-04-29 02:17:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f00a35dfc66dddbf40ce21e3aa1e8777 SHA-1: ccb7d0f490405734cc00363091160e1bc38c2458 SHA-256: 91def2149c2cc830db58363614f76333a0ac9d684757b288b460f11d28bd0d52
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URLs, although some are marked as benign, point to suspicious PDF files hosted on compromised websites, suggesting a phishing or malware distribution scheme. The PDF structure itself contains unusual elements, such as duplicate object bodies, which can be used to evade detection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ltgtrends.com/wp-content/plugins/super-forms/uploads/php/files/66cc4d7af7c8535cb1fa9f460901b567/25485368499.pdf
    • https://revapackers.com/wp-content/plugins/super-forms/uploads/php/files/fbtfrq9p40q95d6rala9742lis/42274112666.pdf
    • https://www.sblending.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1607f0fec7d066---kudajexupadonakiwovod.pdf
    • http://www.idenet.net/wp-content/plugins/formcraft/file-upload/server/content/files/1606f4384c4853---91144492916.pdf
    • https://selectwifi.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607cad8ad63c8---podaw.pdf
    • https://www.arphplumbing.co.uk/wp-content/plugins/super-forms/uploads/php/files/gj8aitq8abat7ut8o87ou721ue/55426253119.pdf
    • http://www.apsetedavisi.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607b1cdbbd188---23577636907.pdf
    • https://precisionautoandac.com/wp-content/plugins/super-forms/uploads/php/files/453bf8f235907d0dba228c2bcfb8c495/lufunufi.pdf
    • http://aksaaydinlatma.com/img/editor/image/file/61375024676.pdf
    • http://alternativefitness.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/16083c22e25073---48879677487.pdf
    • https://dmddsgn.com/wp-content/plugins/super-forms/uploads/php/files/6b00e8d29f3a95c45e87bb58e15b855f/jororerididoke.pdf
    • https://pinotcar.com/wp-content/plugins/super-forms/uploads/php/files/467828b6dbc6a5232b20ce005bb223fb/xixujoginusibirefipu.pdf
    • http://parkwestresidences.com/wp-content/plugins/formcraft/file-upload/server/content/files/160716f870add2---zosunoketidigawan.pdf
    • https://bladmedyczny24.pl/wp-content/plugins/super-forms/uploads/php/files/f3d4f380704a22287772136380399fca/legukopiko.pdf
    • https://www.marbelitesa.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/16077585d377a0---47273421820.pdf
    • http://totaleclipsenv.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607228d25e83c---7244019257.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/Uplcv/~3/BkSY9tpko7c/uplcv?utm_term=assembler+pdf+avec+foxit+reader
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ecfa.bin
67f06dbda084e1172c5ccaf90dc41055d20d5e244b00cab27caabd78fb08660a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECFA 5560 bytes
font_01_sfnt_off0000ffcd.bin
684c2c0149477298f6fc4bce2037cfbab7f13164ae0ba54b3c94bf3e015923c1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFFCD 11684 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.