Malicious PDF — malware analysis report

Static analysis result for SHA-256 9887a8b5d9bcf571…

MALICIOUS

PDF

81.1 KB Created: 2021-03-16 04:48:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: af52b24c432acb75b5846f77547642fb SHA-1: 5630bb037dbb516fcfaf1b6fa5926f9dd024d138 SHA-256: 9887a8b5d9bcf5713841e7dd48b08d5ace973efcb0fd6257a0c8e968a85b10f9
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL, https://dafemum.ru/wix?keyword=the+seasoned+schemer+pdf, suggests a phishing or credential harvesting attempt. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a common phishing lure, likely intended to trick users into visiting a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=the+seasoned+schemer+pdf
    • http://twirlini.com/college_football_predictions_this_week_bleacher_reportyjo14.pdf
    • http://nesobaka9.xyz/what_is_international_marketing_definitionuf8ym.pdf
    • http://businessoutsourcing.info/europass_curriculum_vitae_downloadvi2hb.pdf
    • http://shoppermarket.online/successful_college_writing_6th_edition_downloadg8in8.pdf
    • https://cdn-cms.f-static.net/uploads/4451049/normal_600fbba90969a.pdf
    • http://lovelid.xyz/317121911830xz1r.pdf
    • https://cdn-cms.f-static.net/uploads/4464539/normal_60137d087553e.pdf
    • http://soul-felt.com/mudizometoxivenodiarej6.pdf
    • http://teksalle.xyz/20039628040khp7f.pdf
    • https://cdn-cms.f-static.net/uploads/4486344/normal_601dd4156cce3.pdf
    • http://helpcenterbusiness.xyz/gotasuzujovedubare04l5.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://46c0acaa-de7d-4f46-84f0-c2cf1d8ff7d9.filesusr.com/ugd/ac1638_4e195ce7f7fe44aeada966fccf1fc559.pdf?index=true
    • https://5090c2af-253d-40c3-bfb7-942fc6db26b0.filesusr.com/ugd/0511f5_09563dc41a9540f38e9a0b12fa019f28.pdf?index=true
    • https://s3.amazonaws.com/gawabog/angular_4_interview_questions_for_experienced.pdf
    • https://s3.amazonaws.com/dixaleko/2486803245.pdf
    • https://s3.amazonaws.com/goveruduzewoxu/arthrex_tightrope_technique_guide.pdf
    • https://uploads.strikinglycdn.com/files/65501074-a058-40e5-97df-8fd0d89e9949/tupperware_mini_rice_maker_instructions.pdf
    • https://uploads.strikinglycdn.com/files/d71f36ce-3499-42b0-942b-339cda29acbf/17625789321.pdf
    • https://s3.amazonaws.com/kukupunopedon/65312010578.pdf
    • https://6f46ab72-b8e3-4ec2-8f01-cb5d6491dab7.filesusr.com/ugd/9a120b_f472a9c940724d95a34366538bc0f79f.pdf?index=true
    • https://s3.amazonaws.com/rodiligarexo/gapazurunifumifidizov.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f2cf.bin
3b6c3edccbbdf68622c80e44ac099bd4bffa00507f4f1bc839f0bdbf087aa810		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF2CF 3080 bytes
font_01_sfnt_off0000fdd9.bin
18a5e3f2f6b1b19ebac656e4dc31c2cd6a5a7c2fdef1a1d9f8771b6adb3772fb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFDD9 5312 bytes
font_02_sfnt_off00010fba.bin
7c1a86a80714ffc153564f1c6a6461103e57d90ac4bb4b00142ad19bdd2e8123		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10FBA 11644 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.