Malicious PDF — malware analysis report

Static analysis result for SHA-256 92eb237ce3eea54e…

MALICIOUS

PDF

214.3 KB Created: 2020-12-16 20:47:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: b0b3dae011fbba4e9576b8dd5994deef SHA-1: d1bf0fdbcddb97ba7fe005242e41d4a11076aec9 SHA-256: 92eb237ce3eea54e95b78c46b6e7c53e7ec2e86d14cd5f26040e146aba54a453
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a suspicious domain, disguised as a user guide. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware distribution. No scripts were extracted, but the presence of an external URI suggests an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9964

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/123?utm_term=opencl+user+guide PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4384142/normal_5fb5b2cd48f85.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415974/normal_5f9b74d7abbb9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4468259/normal_5fba5f30686af.pdfIn PDF document text
    • https://pomawuro.weebly.com/uploads/1/3/4/3/134368023/dizufilaxexita.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370762/normal_5f8a67d09b450.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369796/normal_5f88d689316fc.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4385848/normal_5fc775f97cb04.pdfIn PDF document text
    • https://kavirozix.weebly.com/uploads/1/3/3/9/133999962/5656428.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4414868/normal_5faeba2041774.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/minegikukovel/exercices_de_chimie_atomistique.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc10f0fab79f442f22a8155/t/5fcbced21ef6d1662ff909a2/1607192275902/movies_2019_list_bollywood.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fceacedfba3275400764e3a/t/5fd66025dca2215260418230/1607884839387/b._ed_form_fill_up_last_date.pdfIn PDF document text
    • https://s3.amazonaws.com/jidagafinuxesu/acrylic_sheet_supplier_in_the_philippines.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002fd83.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2FD83 4752 bytes
SHA-256: bdd44c353aff9da4b2131645524b47b4e9f0dc415d10cc484aed3ab8795da2fd
font_01_sfnt_off00030da8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x30DA8 14868 bytes
SHA-256: 315b6c1daaadc3f1eee190b9ace9fd4b50c831d32959fc705caa267798eb25cf
font_02_sfnt_off00033bce.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x33BCE 4324 bytes
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3

Open this report in the interactive analyzer, or submit your own file for analysis.