Malicious PDF — malware analysis report

Static analysis result for SHA-256 994c64160ccf4024…

MALICIOUS

PDF

82.7 KB Created: 2021-03-17 02:20:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a57bf379527e2c40346ab77bdfcc0731 SHA-1: b6464816a73f45541870ca9b7a6c911c8d7e2d6f SHA-256: 994c64160ccf4024955fc3517f427e777b566090d21991ed3ee92950a026ff88
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating external URI usage and is flagged by ML classifiers and ClamAV as malicious. The document body, though heavily obfuscated, contains text related to 'checkbook register spreadsheet', suggesting a phishing lure. The embedded URL points to a suspicious domain, likely intended to host further malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/123?utm_term=checkbook+register+spreadsheet+123
    • http://domsale.xyz/what_were_the_consequences_of_the_iron_curtain_speechfoiyj.pdf
    • http://evakuator-uga.ru/what_is_the_best_strength_training_equipmentxol5b.pdf
    • https://static.s123-cdn-static.com/uploads/4473926/normal_5fe2e9ac773b4.pdf
    • http://rankingcoach-apps.com/liwegalopigieo8i8.pdf
    • http://topcreditcheck.info/38491376247odw1n.pdf
    • https://static.s123-cdn-static.com/uploads/4373261/normal_5fef6334a6bfd.pdf
    • http://hookup154.space/8615102360hglx0.pdf
    • http://trokot-shopnew.online/rheem_electric_hot_water_heater_reset_buttonqy7m0.pdf
    • https://cdn-cms.f-static.net/uploads/4470526/normal_601ee825679bc.pdf
    • https://cdn-cms.f-static.net/uploads/4485587/normal_605149248ed8f.pdf
    • http://outputqwvk.space/wajudogifuwowinoloxejev98in.pdf
    • http://letnesil.xyz/fuberubh58l0.pdf
    • https://cdn-cms.f-static.net/uploads/4420018/normal_600dae4175a75.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://wojibikifi.myartsonline.com/holding_up_the_universe_quotes.pdf
    • https://uploads.strikinglycdn.com/files/166ba343-4b3a-41ff-8df7-e985f6b7780b/viwanusi.pdf
    • https://uploads.strikinglycdn.com/files/0807110f-1526-41b8-967f-a29956595424/how_do_you_reset_a_hardwired_smoke_detector.pdf
    • http://kofepiropi.onlinewebshop.net/geometric_sequence_activity.pdf
    • https://uploads.strikinglycdn.com/files/9aa0216b-2381-4329-9079-65542f03b09d/kasula.pdf
    • https://uploads.strikinglycdn.com/files/3986b8b5-d6f9-433f-ac75-e62cc26e9dc1/39188153276.pdf
    • https://uploads.strikinglycdn.com/files/f982de0c-5b8c-48df-86c2-8e9f464c5dfc/vafonijeraduniw.pdf
    • https://uploads.strikinglycdn.com/files/1602f079-fa4e-408a-980c-12a6e68e0b34/tamil_magazine_subscription.pdf
    • http://lufevexos.atwebpages.com/pabobitog.pdf
    • https://uploads.strikinglycdn.com/files/979f21b8-1885-4dc8-8934-8ed06611b019/65250321465.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4eb.bin
ef0ff104ea44b4f76f2e317c05d944ff73adab4e11d451763276b796cfc564ed		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4EB 2868 bytes
font_01_sfnt_off0000ff1d.bin
4204cf4d8cf0a501a8f6a514599f7d77e5490d18113270b5802e6e97712f8faf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF1D 5760 bytes
font_02_sfnt_off000112ab.bin
0a1768ac25878220b8b51a163fdbd4cf8391e142c3001d906c8f5686bd32552f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x112AB 12240 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.