Malicious PDF — malware analysis report

Static analysis result for SHA-256 9749ab5b81f13fa9…

MALICIOUS

PDF

85.6 KB Created: 2021-03-24 09:16:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d625f6ead1f3613258797eb3c118f94e SHA-1: b6e76e35db145ea2830675cdda6c236eb0456e5a SHA-256: 9749ab5b81f13fa98e235ced3bf0ac04d81eb186870f3bb97b5ebbdd7f3d6f47
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The PDF contains embedded URLs that redirect to potentially malicious sites, suggesting a phishing or credential harvesting attempt. Although no scripts were explicitly extracted, the PDF structure and embedded URIs are indicative of a common phishing lure, likely attempting to trick users into downloading further malware or visiting a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=kenmore+elite+undercounter+ice+maker+manual
    • http://organicnu.info/among_the_barons8pxfm.pdf
    • http://marifivelaj.mygamesonline.org/kevufidumupimu.pdf
    • https://cdn-cms.f-static.net/uploads/4500440/normal_6055ccde39852.pdf
    • http://about-igsupport.com/marvel_movie_filmyhitoyzci.pdf
    • http://kavademive.sportsontheweb.net/marine_safety_officer_training_course.pdf
    • http://aov.one/jolly_phonics_student_book_2n2ets.pdf
    • http://medyayazilimtr.com/9th_class_ka_english_bookakjr7.pdf
    • http://xifadezuzurap.medianewsonline.com/charting_the_outcomes_fellowship.pdf
    • http://theboldpantsproject.com/wemagimovabulekevebiwd000.pdf
    • http://sun-italy.space/html5_css3_for_dummiesxoo7k.pdf
    • https://static.s123-cdn-static.com/uploads/4393183/normal_5ff55c54f16ff.pdf
    • https://cdn-cms.f-static.net/uploads/4419633/normal_601b673061ea8.pdf
    • http://damvglaz1.xyz/dovepibitavewolimeltdcft.pdf
    • http://ukrinsure.com/welominipuj3s1nd.pdf
    • http://xogiraj.iblogger.org/what_is_the_job_of_a_chief_compliance_officer.pdf
    • http://italysummer.fun/273657597395kcqm.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://lofufizopugopo.rf.gd/chrome_advanced_settings.pdf
    • http://pazokidewuwi.rf.gd/kixalefumosibusat.pdf
    • http://wovibojo.onlinewebshop.net/radiometric_correction_in_remote_sensing.pdf
    • https://5c126656-fc4f-473b-8c99-11744d2e1b96.filesusr.com/ugd/abd8ec_aa07e1e1fc1c488fb05c031a4db324dc.pdf?index=true
    • http://pepiretivixu.epizy.com/how_to_adjust_citizen_eco_drive_watch.pdf
    • http://jomepow.rf.gd/93324259494.pdf
    • https://83f018a0-8e49-44f0-b57e-805e464a5f06.filesusr.com/ugd/10a4aa_cc8a5f0b5a084fe28297a5fca915b156.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010ef0.bin
2eb0879364a1a99db1d0071a662df5c853ce6275414008175f304a41416a34b8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10EF0 4940 bytes
font_01_sfnt_off00011f9d.bin
c5aa59885fd7f9049b25bc12d91f38a01c4435d98d9a1da8784a6dcd62d0189e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11F9D 12064 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.