Malicious PDF — malware analysis report

Static analysis result for SHA-256 93a8f8edcea09ec8…

MALICIOUS

PDF

178.9 KB Created: 2021-05-11 01:50:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: d4245e91ba9f11cbf41ef69328608b10 SHA-1: b1db7e58950085ff33c9e2d7aa8a06ec4873f9dd SHA-256: 93a8f8edcea09ec8dd8cb5b0b19c3ee043b6bdb5b1ec319ae7c6859c779d1e8e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9977

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/strik?utm_term=introduction+to+ordinary+differential+equations+solutions+manual+pdf PDF link annotation
    • https://mamexobupelo.weebly.com/uploads/1/3/1/3/131383482/4789383.pdfIn PDF document text
    • http://bcpzon4segurabetaviabcp.com/dabixoluzipn9dgq.pdfIn PDF document text
    • https://nozodipipagim.weebly.com/uploads/1/3/1/4/131438171/wotanonapilojo-jubesivuja.pdfIn PDF document text
    • https://cdn.sqhk.co/lilaxikixo/iciiekA/space_shuttle_drawing_easy.pdfIn PDF document text
    • http://fb-ig-violation.com/hoover_steam_cleaner_user_manualhjkuf.pdfIn PDF document text
    • https://cdn.sqhk.co/sevafeluba/ijeij8i/subterfuge_pronunciation_francais.pdfIn PDF document text
    • https://piligerababuge.weebly.com/uploads/1/3/5/3/135324290/e61fb7.pdfIn PDF document text
    • http://bankrot-biznes.ru/what_is_ati_in_nursing_schoolag9bf.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/wovedukevikov/54232591755.pdfIn PDF document text
    • https://s3.amazonaws.com/vokeri/bose_soundsport_headphones_android.pdfIn PDF document text
    • http://ludatijodibop.rf.gd/resojojuvuwofufuno.pdfIn PDF document text
    • https://s3.amazonaws.com/nafamaragisek/management_report_sample.pdfIn PDF document text
    • http://bapaxezeb.epizy.com/gosijamesegizafazikexufax.pdfIn PDF document text
    • https://s3.amazonaws.com/wizakokowe/how_to_change_language_on_sandisk_clip_jam_mp3_player.pdfIn PDF document text
    • https://s3.amazonaws.com/vekodupiwarobi/womanatuxateb.pdfIn PDF document text
    • https://s3.amazonaws.com/satulibaren/photoshop_template_for_facebook_cover_photo.pdfIn PDF document text
    • https://s3.amazonaws.com/dosalapasenow/apple_watchos_6_gm.pdfIn PDF document text
    • http://zadajipi.epizy.com/riwebalipebidug.pdfIn PDF document text
    • https://s3.amazonaws.com/dazemi/nofefetezijaveloda.pdfIn PDF document text
    • http://zinipaxafuzonik.rf.gd/3068783951.pdfIn PDF document text
    • https://s3.amazonaws.com/sudevejerifu/free_adobe_reader_apps.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00024ee6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x24EE6 5348 bytes
SHA-256: ef9b4e8c2fd86dc7c602ea115cb1c97d27525dc324649ab61170bf689bc9ffe8
font_01_sfnt_off00026100.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x26100 15852 bytes
SHA-256: 96dcc29b98636065efb15090c8250905f8701295a51fa21af427539527556370
font_02_sfnt_off00029522.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x29522 17256 bytes
SHA-256: 290d4c8b7e0b94ecd649d3c0fc5c9246b97e76d950af92406ba53b330f167a63
font_03_sfnt_off0002aeba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2AEBA 4324 bytes
SHA-256: a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f

Open this report in the interactive analyzer, or submit your own file for analysis.