Malicious PDF — malware analysis report

Static analysis result for SHA-256 9a93608cb3f3df16…

MALICIOUS

PDF

80.0 KB Created: 2021-03-30 09:24:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f36c16c728a50ae02101e07372b213a2 SHA-1: d779f17209004fefbef27572555675f8296610ca SHA-256: 9a93608cb3f3df1669c9948182eba2558ad9c238574bd28a19eab14b7a6c016f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URL pointing to a suspicious domain, likely intended to trick the user into downloading further malware or visiting a phishing page. The document body, though heavily obfuscated, suggests a lure related to software cleanup or updates.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/123?utm_term=remove+bloatware+android+8
    • https://cdn.sqhk.co/dutebosatu/VxicicT/zawusobeno.pdf
    • https://cdn.sqhk.co/pulovafafita/0Zgfbjf/tupogilefirofugubefa.pdf
    • https://cdn-cms.f-static.net/uploads/4379987/normal_60183e74356f1.pdf
    • https://static.s123-cdn-static.com/uploads/4368485/normal_5ffe90d75a673.pdf
    • https://cdn-cms.f-static.net/uploads/4446036/normal_604a692c44f2a.pdf
    • https://cdn.sqhk.co/tategupet/J0jgb4Q/vuvedujixar.pdf
    • https://cdn.sqhk.co/wuzufoxo/jaihjfr/make_a_synonym_match_challenge_answer_key.pdf
    • https://cdn.sqhk.co/xedomobedusi/jdrD2ge/epic_games_launcher_for_windows_7.pdf
    • https://cdn-cms.f-static.net/uploads/4447276/normal_60499da6d490d.pdf
    • https://static.s123-cdn-static.com/uploads/4455876/normal_5ffcc00b5ca97.pdf
    • https://cdn-cms.f-static.net/uploads/4385207/normal_60172e5be6589.pdf
    • https://cdn.sqhk.co/gotuxixovumu/giigidZ/camera_studio_near_me.pdf
    • https://cdn-cms.f-static.net/uploads/4370764/normal_603c0bf0e0a30.pdf
    • https://cdn.sqhk.co/gusisitixinu/bghia1F/38174155321.pdf
    • https://cdn-cms.f-static.net/uploads/4368768/normal_60343e8481bf5.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/3b506773-411a-4331-8ca7-f63f3b2173a8/old_skool_vans_black_laces.pdf
    • https://uploads.strikinglycdn.com/files/74ad070c-6aa0-4ea6-b50f-2e2e25ee6162/nomedobodapijepufokafufu.pdf
    • https://uploads.strikinglycdn.com/files/000bcc73-3c72-479b-b566-80992d579e0f/86178542646.pdf
    • https://uploads.strikinglycdn.com/files/8fca0316-3863-43fa-88f0-542f1ba40b68/33556326306.pdf
    • https://uploads.strikinglycdn.com/files/5213c67d-e531-4d56-9ac6-8bf48e540849/how_to_service_a_lennox_furnace.pdf
    • https://uploads.strikinglycdn.com/files/637f9dd4-c2c3-444e-b9c9-693f7c5f2dad/jimitifixerogosiketejisem.pdf
    • https://uploads.strikinglycdn.com/files/79209da0-bb54-449d-b885-402103bf660f/2019_honda_pilot_service_codes.pdf
    • https://uploads.strikinglycdn.com/files/98cbac85-8afd-4078-9f2d-8ea1d5c7d376/43692161348.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f9e7.bin
de4999f0902199ebfde137f85177a18ed425a3042200e9a3aa175352ac15e5af		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9E7 5284 bytes
font_01_sfnt_off00010bdf.bin
f06dbd1abc46b49a237c9df2f6ed998743c805d027d41156395df3e89e334f14		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10BDF 11364 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.