Malicious PDF — malware analysis report

Static analysis result for SHA-256 986a2c04426003b9…

MALICIOUS

PDF

75.3 KB Created: 2021-05-06 20:50:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 156535a8ce2439a405f22022d38ca91e SHA-1: 7bb8231a0e3832d07b5413b5a0db20d27fa61645 SHA-256: 986a2c04426003b923ad078d310a552932aa87845ae1d1797535ff57bcdeca8f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of embedded URLs and the PDF structure suggest it is designed to trick users into downloading further malicious content, likely a phishing attempt. No scripts were extracted, but the PDF structure itself is indicative of malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://stakeoutllc.com/wp-content/plugins/super-forms/uploads/php/files/c191002e6d9792d15003555fd22534fc/73046987395.pdf
    • https://3dreamvr.com/wp-content/plugins/super-forms/uploads/php/files/21106f5db37182655d3c09a94ac449fd/89055757918.pdf
    • http://www.studiolegalefusimorelli.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608157945bcd2---suwiririgunurivow.pdf
    • http://www.next-conseil.fr/wp-content/plugins/formcraft/file-upload/server/content/files/160782d006053f---24768996914.pdf
    • http://anhuizhkj.com/upload_fck/file/2021-5-2/20210502214329919686.pdf
    • https://kolodezrus.ru/wp-content/plugins/super-forms/uploads/php/files/224043ec20dbe15f8fee7b1443562ab9/61541584990.pdf
    • https://www.lorenzofranzone.it/wp-content/plugins/super-forms/uploads/php/files/e47d1d389957639d520953537f20e358/1421438620.pdf
    • http://nutricion-intravenosa.com/wp-content/plugins/super-forms/uploads/php/files/87ddb0baea6e8c986674047fea93a025/5805994142.pdf
    • http://neodev.space/wp-content/plugins/formcraft/file-upload/server/content/files/160872e2f33ebe---bapukuguzowo.pdf
    • https://mindweave.co.uk/wp-content/plugins/super-forms/uploads/php/files/fdg296v0lgrjhv09lqnaafosu8/korafum.pdf
    • http://www.marsagri.com/wp-content/plugins/formcraft/file-upload/server/content/files/16084e7170d18d---panezub.pdf
    • http://ajivikafinance.com/userfiles/file/fajozilel.pdf
    • http://www.everhouse.lt/wp-content/plugins/formcraft/file-upload/server/content/files/16087f4de70861---fivuwomabemuse.pdf
    • https://www.swissfillon.com/wp-content/plugins/super-forms/uploads/php/files/472b1233e6e7b798e60d7875176b346f/nezegatitarepewepinex.pdf
    • http://oneself.pro/wp-content/plugins/formcraft/file-upload/server/content/files/1607d5f204ea53---58554837488.pdf
    • https://limpjet.com.br/wp-content/plugins/super-forms/uploads/php/files/73167d7b90ae385393402281212b253f/60943375385.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/YTWXjIUwRh0/uplcv?utm_term=antivirus+para+android+gratis+2019
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e451.bin
bcd64f504e9f338e06ab34ac32459f2fd4977460ca47d8c46d2cdb794ea00ae4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE451 5624 bytes
font_01_sfnt_off0000f78a.bin
7814f937afa99b3df284783c9ca5a73cc3815265ff8ce8e24cf88b18a93cea40		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF78A 12120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.