Malicious PDF — malware analysis report

Static analysis result for SHA-256 998c9ca24f02a0a9…

MALICIOUS

PDF

78.7 KB Created: 2021-03-29 21:43:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: acce03d70eed25071d02bea1d44c7ad9 SHA-1: 2ee625ddc1aa8492aeeebc97d96eab62126746e8 SHA-256: 998c9ca24f02a0a9dfd99011d4d4d68e98c566c758745a0bbf87d300748b784c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL leading to a suspicious domain. The ML classifier and ClamAV detection strongly indicate malicious intent, likely phishing or malware distribution. The document body, though heavily obfuscated, contains keywords related to the URL, suggesting a lure to trick users into visiting the malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/award?keyword=allah+99+names+meanings+pdf
    • https://cdn.sqhk.co/zijikunu/tqjgEQC/iron_punch_game_mod_apk.pdf
    • https://cdn-cms.f-static.net/uploads/4368750/normal_604d3e4f0f5f9.pdf
    • https://cdn.sqhk.co/zafowavo/je52ja4/voxarirowijexogu.pdf
    • https://cdn.sqhk.co/tipekafomube/4ojhhjg/childbirth_delivery_videos_free_mp4.pdf
    • http://fusubakitakudup.66ghz.com/how_did_colonialism_affect_kenya_dbq_answers.pdf
    • http://phrensy.co/scarlet_letter_cliff_notesc4uu5.pdf
    • http://my-favshopf.online/55574808013b4e5y.pdf
    • http://bestrongbyg.com/emotion_power_assist_wheelchair_wheelsxyhsb.pdf
    • http://groshyk.site/1040347804omz40.pdf
    • https://static.s123-cdn-static.com/uploads/4473619/normal_5ffea1aa0ad1a.pdf
    • https://cdn-cms.f-static.net/uploads/4529095/normal_6031ef2c2e4d8.pdf
    • https://cdn-cms.f-static.net/uploads/4488329/normal_601fad19e3096.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/69de3779-1b1b-4db4-93eb-b2ffda7af624/calories_arbys_roast_beef_slider.pdf
    • http://nunozufivov.epizy.com/welonudakatokik.pdf
    • http://kolofagigetu.epizy.com/avesta_download.pdf
    • https://uploads.strikinglycdn.com/files/a1da3cb3-3070-496f-840b-9e3a88723cfb/55240344786.pdf
    • http://dupopat.epizy.com/gym_workout_plan_for_weight_loss_for_womens.pdf
    • https://uploads.strikinglycdn.com/files/46c78842-338d-48d8-a868-71fdc481b162/54977051964.pdf
    • https://uploads.strikinglycdn.com/files/1d93192b-bd9d-4187-b081-217d7aca7500/88685858968.pdf
    • http://lofatis.epizy.com/16884912757.pdf
    • http://fizanotafogibag.rf.gd/graco_milestone_all-in-one_car_seat_review.pdf
    • http://pinopog.rf.gd/rivamevurejiz.pdf
    • https://uploads.strikinglycdn.com/files/9dce3d78-e60d-4a9b-8212-389e0daa6f31/gobafetepiribiragupojevuk.pdf
    • http://bizurano.epizy.com/deep_learning_algorithms.pdf
    • http://zesukojuwuveg.rf.gd/tosebodazafevux.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4ad.bin
a7fabe5cf4d6ba6d6e4ec22fe33b480a5246fe1fbb9d8ac2e2b77f3d1494e8ba		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4AD 5504 bytes
font_01_sfnt_off00010749.bin
f5db4bc130977a8978514afc8922d987a2594c80a4f706ae038cc285c0008b78		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10749 11484 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.