Malicious PDF — malware analysis report

Static analysis result for SHA-256 9c0f507f08bb0cfd…

MALICIOUS

PDF

78.3 KB Created: 2021-03-12 13:05:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: effdc86cb2cb02448fdf9980014cc266 SHA-1: bf6c673e567c416f0506d02d4a62e59c9732ce5e SHA-256: 9c0f507f08bb0cfd797a5cbd775e8a2f04d2d3c25e554234e25829b29119869e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with heuristics indicating the presence of external URIs. The document body, though heavily obfuscated, contains text fragments that suggest a lure related to 'logo barcelona dls 19'. The embedded URLs point to suspicious domains, indicating a likely phishing or malware distribution attempt. No scripts were extracted, but the PDF structure itself likely facilitates the redirection to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/123?utm_term=logo+barcelona+dls+19
    • http://leopolds.space/asuran_tamil_movie_bgmicfsq.pdf
    • https://kaxogirigajel.weebly.com/uploads/1/3/4/6/134611066/7458618.pdf
    • http://istlan.fun/twitter_lite_apk_for_android_2._3e9fm0.pdf
    • http://creditchecktotal.info/how_the_metric_units_for_length_volume_and_mass_are_related9vboz.pdf
    • https://puxodemidumez.weebly.com/uploads/1/3/5/3/135345879/9419.pdf
    • http://jobs-ingenieur.best/48862510434yg0qj.pdf
    • https://jotavitot.weebly.com/uploads/1/3/0/7/130738821/6533d2.pdf
    • https://cdn-cms.f-static.net/uploads/4376126/normal_6025198a40074.pdf
    • https://masiwirisiniziz.weebly.com/uploads/1/3/1/4/131453333/sufaba_vumax_soreranogono.pdf
    • http://ukranews.site/kreepy_krauly_legend_partsawyit.pdf
    • https://static.s123-cdn-static.com/uploads/4494875/normal_6004cacf2cacf.pdf
    • https://cdn-cms.f-static.net/uploads/4388046/normal_6016f2d19403f.pdf
    • https://bofejaximolapob.weebly.com/uploads/1/3/4/7/134751884/a618bcb.pdf
    • https://viradigoposexa.weebly.com/uploads/1/3/4/3/134383508/353917.pdf
    • https://begobaxu.weebly.com/uploads/1/3/5/3/135336669/49a6406f2c.pdf
    • http://kuxni.su/tesiwepagivowitifirij50ue.pdf
    • https://static.s123-cdn-static.com/uploads/4475847/normal_5fe3f73451560.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/785305c8-dca6-47d0-8f84-e65319b565dd/organic_chemistry_solutions_manual_klein.pdf
    • https://uploads.strikinglycdn.com/files/c5a0de9e-a4e5-4e79-8fb3-0a1b85834a31/brother_serger_1034d_parts.pdf
    • https://uploads.strikinglycdn.com/files/0d7e4d30-23a5-4334-b99d-b598cf52a857/creative_writing_prompts_middle_school.pdf
    • https://uploads.strikinglycdn.com/files/9c04f455-6d3b-431b-a747-eea27ad5dedb/98683874544.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e70f.bin
700b17434a036ce430d5a7309c8f89237c18e3064e227933ada31c8bd28750d6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE70F 5056 bytes
font_01_sfnt_off0000f83d.bin
40f16784c4320672a9814268fd13ac9de3c4b9e12a05fedb2efa65fd56c11cf5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF83D 11040 bytes
font_02_sfnt_off00011ddb.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11DDB 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.