Malicious PDF — malware analysis report

Static analysis result for SHA-256 95c581e693aa9205…

MALICIOUS

PDF

106.5 KB Created: 2021-06-27 23:05:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 28ea2607963712a23d11967a7208a625 SHA-1: c2251b452c9925c12d8dde18d50722777a32ee95 SHA-256: 95c581e693aa9205f6b5c8107d7f523f06bc03289f97337d628c020d52a8f721
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL, though benign in reputation, points to a PDF that likely serves as a lure for further malicious downloads. The presence of multiple unknown reputation URLs further supports the phishing or malware distribution vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9922

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fonnepal.org/userfiles/file/97284964810.pdf
    • https://robotics-institute.com/wp-content/plugins/super-forms/uploads/php/files/vtueedm6es383b9ei1bca47qmc/fajedekejafisakozogin.pdf
    • http://bayzones.com/fckeditor/editor/filemanager/connectors/php/userfiles/file/beximiboxesifukapikut.pdf
    • http://jeugdopdewetenschapsagenda.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1607b5621c4cbd---18348511639.pdf
    • http://bluenanum.com/ckupload/files/34800475684.pdf
    • https://nhathuydesign.com/wp-content/plugins/super-forms/uploads/php/files/9tdil2pkvheit8gq1betqe6bgf/58449240163.pdf
    • http://namthangbasaltstone.com/uploads/image/files/78474634451.pdf
    • http://topopentertainment.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c8c92d44ff---tagubo.pdf
    • https://www.psalighting.com/wp-content/plugins/super-forms/uploads/php/files/ac7a45d9a0867b30b232c3778788182e/20805665366.pdf
    • http://www.anclupnapoli.it/userfiles/file/pifirovafav.pdf
    • https://vakukh.ru/wp-content/plugins/super-forms/uploads/php/files/7133d913ed80b363d270e15e8ba6c3f8/52504618456.pdf
    • https://www.baileysmilk.com/wp-content/plugins/super-forms/uploads/php/files/9686974d338ffc11df41e43ee0e9fd35/41546993445.pdf
    • http://mountmedpharmacy.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160d791054a68f---7511806104.pdf
    • https://tirthmobile.com/wp-content/plugins/super-forms/uploads/php/files/ebjsu62cn2mkd40atq7mbmppsj/bolumojop.pdf
    • https://cissud.com/uploads/ck_editor/files/xejedokadupotazo.pdf
    • https://landlorddebtadvisory.com/wp-content/plugins/super-forms/uploads/php/files/2tvg9tbuebl5msghuom4qd8255/puruzidirolobofudizasevaw.pdf
    • http://rudolphalexander.com/uploads/files/silejig.pdf
    • https://tort-art.ru/userfiles/file/nokadeduma.pdf
    • https://www.mclarenpress.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083ac95300a6---17525963370.pdf
    • https://oiweld.com/wp-content/plugins/super-forms/uploads/php/files/66a2b270a4eca7c61097c996e8b82c99/vofajow.pdf
    • https://member-amz-seller-system.de/wp-content/plugins/super-forms/uploads/php/files/9b0babcf3f5ff0e81c1adfba21644526/9271620607.pdf
    • http://szpital-sulecin.pl/images/fckfiles/file/7711994318.pdf
    • https://drainscovers.com/wp-content/plugins/super-forms/uploads/php/files/e74d9c719444d016fe6a92ddcd295332/wetakopatazonoxul.pdf
    • https://nikken-engineer.jp/export/sd205/www/jp/r/e/gmoserver/8/6/sd0748886/nikken-engineer.jp/fckeditor/upload/file/29751828172.pdf
    • https://euforbiabulgaria.com/uploads/pages/files/lagipobu.pdf
    • https://feedproxy.google.com/~r/skout/mBVl/~3/ngfLrbzwjls/uplcv?utm_term=application+of+complex+numbers+pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013793.bin
d08a0443a28e228e342ae38e39ac3f41bbe0d1b8b86699d6c0e3b50ce85b92ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13793 18864 bytes
font_01_sfnt_off000168f6.bin
58a77455f9cc00d905416956f5f99f6f298225a4d88aa51030198c344b6fdd28		 pdf-font-stream PDF embedded font (sfnt) at offset 0x168F6 11104 bytes
font_02_sfnt_off000182b2.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x182B2 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.