Malicious PDF — malware analysis report

Static analysis result for SHA-256 9b0954aac02e8ced…

MALICIOUS

PDF

72.9 KB Created: 2021-04-05 23:08:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-17
MD5: 15301ffd3beea403bb385a9535dc9920 SHA-1: 4b8402783feded28256397ae0377c0c82d98e711 SHA-256: 9b0954aac02e8ced15ae0a2b8a96aa41791c216d8d33cdbc328505ddce213ebf
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or trojan payload. It contains an embedded URI pointing to a suspicious domain, likely intended to deliver a secondary payload or redirect the user to a phishing site. The document body, though heavily obfuscated, contains keywords related to printer ink, suggesting a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=epson+workforce+320+replace+ink PDF link annotation
    • http://zulamulowegus.iblogger.org/approximation_methods.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4369781/normal_5fcabe65154a9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416806/normal_6043a47de6b5d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4450156/normal_5ff9af563053b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485442/normal_6018a25045258.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403408/normal_6021f98d34bec.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4407066/normal_60677a310f3fb.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4486367/normal_5fec93da816c1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4405651/normal_5fdc5637b1988.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447270/normal_5fd680ca8cdda.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4404515/normal_5fc67a0d8e86b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/94b9a9f8-58ee-496c-bbe6-268ebec7d64a/what_type_of_knife_is_best_for_self_defense.pdfIn PDF document text
    • http://tapeperogu.rf.gd/68048159356.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/89f58fb9-5694-4681-8f72-c316c397caf2/what_order_do_i_read_the_house_of_night_series.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2abf80f0-d6fc-4598-a4f9-d4adba2db636/what_is_the_best_salt_for_my_water_softener.pdfIn PDF document text
    • http://jemekovivokuvup.epizy.com/performance_improvement_plan_status_report.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e1d9bc11-2904-4ffb-b20e-b4b6312358b7/niveles_de_lectura_comprensiva_microprocesos_y_macroprocesos.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0889425b-eb02-4666-bac5-2c97bc3d7658/bitexipeboranetux.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2aa8d9ba-e5dc-4e26-b09c-50ea2622c702/multiplying_fractions_worksheets_for_6th_grade.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e023.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE023 5560 bytes
SHA-256: 2beec76d73e4defc05279a4536913d00d9815e5ab59a40b2e8392789d1d2e2f3
font_01_sfnt_off0000f339.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF339 10304 bytes
SHA-256: ffe1f7f3cf0e3997fc3041501936190eac80a42d8989f84ee3dd287941ecd392

Open this report in the interactive analyzer, or submit your own file for analysis.