Malicious PDF — malware analysis report

Static analysis result for SHA-256 9ce4f5cde3acc99d…

MALICIOUS

PDF

80.6 KB Created: 2021-03-15 11:49:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dfcb7cf6e2e4b6584a8056cbed79f6d9 SHA-1: f4d5db960bb3372701b8341471d25dd0c719e11b SHA-256: 9ce4f5cde3acc99dfb62a14278dc4ebbaea8ff3a54141dfb2ebc271f56caef0a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains an embedded URL that redirects to a malicious domain, likely to host a phishing page or download further malware. The ML classifier and ClamAV detection strongly indicate malicious intent, consistent with a phishing attack delivered via a document attachment. No scripts were extracted, but the presence of external URIs and high detection scores suggest a typical phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=how+to+fix+a+swingline+stapler+747
    • https://cdn.sqhk.co/zijigemeworu/NorjeZS/rivexovivenikarifito.pdf
    • https://static.s123-cdn-static.com/uploads/4452386/normal_5fcf254ac3fa7.pdf
    • https://cdn.sqhk.co/dodufiruw/iegjBHu/craftex_drum_sander_for_sale.pdf
    • https://cdn-cms.f-static.net/uploads/4457005/normal_60214046375f2.pdf
    • https://static.s123-cdn-static.com/uploads/4459325/normal_5fdf0298bb9b1.pdf
    • https://cdn.sqhk.co/bujutinape/YTjbshg/48810659778.pdf
    • https://cdn.sqhk.co/bubiwalifeda/jfanmji/bifonoti.pdf
    • https://cdn.sqhk.co/firokizita/ag3pGij/chess_java_game_dedomil.pdf
    • https://static.s123-cdn-static.com/uploads/4391642/normal_5ffce3f864242.pdf
    • http://labakugolav.iblogger.org/why_is_world_war_2_significant.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/165471d2-0206-4fdb-8a71-6205dbc8eb64/siwojinuv.pdf
    • https://uploads.strikinglycdn.com/files/756530bc-7358-457e-8120-850bc76b44a7/45180658520.pdf
    • http://zesafemumibow.myartsonline.com/39345323566.pdf
    • http://kojumajofub.rf.gd/toboda.pdf
    • http://tebaputazaxuva.myartsonline.com/34082109887.pdf
    • https://uploads.strikinglycdn.com/files/c578663e-e445-4c45-baed-5d44ae405f63/29906443134.pdf
    • https://uploads.strikinglycdn.com/files/afda36de-97b0-410a-b9f8-2b033b998c16/xotapala.pdf
    • http://vujuvisesakok.myartsonline.com/fezemojevafuluzepiwonezam.pdf
    • https://uploads.strikinglycdn.com/files/4d003007-9c31-40ec-9274-ba0347a6b9f7/27167439913.pdf
    • https://uploads.strikinglycdn.com/files/15b7bec1-73ad-4f66-9a1b-066afdd8c63e/fujibulip.pdf
    • https://uploads.strikinglycdn.com/files/5f799b88-bdf1-40cb-b723-d5e45418d0cc/free_printable_atomic_habits_worksheets.pdf
    • https://uploads.strikinglycdn.com/files/48b6a097-da5d-42f7-af68-229a4478ad4b/69331332139.pdf
    • http://sekovukubetib.epizy.com/muxumesuwepurab.pdf
    • http://nowageg.onlinewebshop.net/apa_style_manual.pdf
    • http://jariluwalube.epizy.com/lutojefemoro.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fcae.bin
4e0170f4b74cf2139cbbaec0a2a24c652b30a233a05b2a1447338e0e8d14238e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFCAE 5356 bytes
font_01_sfnt_off00010f1f.bin
8dbdc7606e313efaa706e3976f1782261af02d4fd48af91db606a31e6c418bf5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10F1F 11128 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.