Malicious PDF — malware analysis report

Static analysis result for SHA-256 98fef78dfa17addd…

MALICIOUS

PDF

70.3 KB Created: 2021-03-09 11:44:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4179e08d042fc98debc0c163b49751a8 SHA-1: a8a488a89185f675abe61a06894966e9c11c9dc2 SHA-256: 98fef78dfa17adddc72ef17e74967744b130dfd00fe28a56621529757899fa7c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to a suspicious domain, likely intended for phishing or malware distribution. The PDF structure also shows signs of manipulation with duplicate object bodies, which can be used to hide malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=adintrend+thai+pbs
    • https://jefiwoso.weebly.com/uploads/1/3/5/9/135996081/5391339.pdf
    • http://davupopebuwiser.sportsontheweb.net/sex_drugs_and_cocoa_puffs_by_chuck_klosterman.pdf
    • http://vinnipoh.space/sanico_inc_binghamton_nycssl2.pdf
    • https://wivaralizufijol.weebly.com/uploads/1/3/1/4/131483386/tozodum.pdf
    • https://sowuritujozefa.weebly.com/uploads/1/3/4/6/134621612/e9f0ec26.pdf
    • http://rostov-mobile-doctor.ru/8249534076w1noz.pdf
    • http://bafedudovodamo.medianewsonline.com/monokilorokalovarawetapu.pdf
    • https://tazumeter.weebly.com/uploads/1/3/1/4/131438167/xixexirijulok-tuwesu-kokobapepigub-lelubudodup.pdf
    • http://savineme.mywebcommunity.org/how_long_does_a_honda_7000_generator_last.pdf
    • http://fulukegoror.getenjoyment.net/blackjack_rules_seven_cards.pdf
    • http://jewogipuwivi.medianewsonline.com/vtech_cs6429-4_manual.pdf
    • https://kukibutojiw.weebly.com/uploads/1/3/0/7/130775835/rifudiw.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://mupopeseri.rf.gd/international_phonetic_alphabet_english_words.pdf
    • http://bufijonewufo.onlinewebshop.net/tasajukexabubo.pdf
    • http://boripodadup.epizy.com/vinowiwituwadagegozisiliz.pdf
    • http://kobuxotaregudes.rf.gd/jolly_phonics_pupil_books.pdf
    • https://s3.amazonaws.com/zulezov/kezetutefemazarev.pdf
    • https://s3.amazonaws.com/foneniz/vehicle_inspection_report_for_insurance.pdf
    • http://vovakupalujum.onlinewebshop.net/honda_harmony_1011_deck_belt_size.pdf
    • http://lixugafepujijoj.onlinewebshop.net/is_epic_software_hard_to_learn.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c97d.bin
81b69537acca093988aedbe409bdf33f40afc63d4b0c0c261bf45f61978c2ae2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC97D 4824 bytes
font_01_sfnt_off0000d9b6.bin
f1c43a35e5f74ad8f56b40e8d6e5a9f52ababe320bbe24437c40c314f0abc95b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD9B6 10536 bytes
font_02_sfnt_off0000fdd8.bin
a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFDD8 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.