Malicious PDF — malware analysis report

Static analysis result for SHA-256 9db3cb777e0d10fb…

MALICIOUS

PDF

151.3 KB Created: 2021-04-06 11:59:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bfd94e14fd8799419085aec88c217d82 SHA-1: d24c87300532606d05ad06e5f13e87cfda1674ad SHA-256: 9db3cb777e0d10fbe6ca10cd76444fcf9b2f608936642cec1cfb69429944c81d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing attempt. It contains an embedded URL that directs users to a suspicious domain, likely to host a malicious payload or phishing page. The document body, though heavily obfuscated, suggests a financial or guideline-related lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/123?utm_term=fnma+guidelines+non+occupant+co+borrower
    • https://static.s123-cdn-static.com/uploads/4415327/normal_5ff7fb7887517.pdf
    • https://cdn-cms.f-static.net/uploads/4460255/normal_60468436e04fd.pdf
    • http://keto-menu.online/telugu_private_dj_bass_songsrajac.pdf
    • http://rinujajija.getenjoyment.net/catfish_farming_guide.pdf
    • http://ideaita.fun/143328104291s2h9.pdf
    • https://boxatikavizag.weebly.com/uploads/1/3/4/6/134680825/2793004.pdf
    • https://cdn-cms.f-static.net/uploads/4388040/normal_6069e1a6a6406.pdf
    • https://fofalada.weebly.com/uploads/1/3/5/9/135968840/816290a2.pdf
    • http://kijofizovurisos.medianewsonline.com/searching_and_sorting_algorithm.pdf
    • http://vizit.store/46471254981l182o.pdf
    • https://static.s123-cdn-static.com/uploads/4449602/normal_6000a170233b9.pdf
    • https://sesuwulot.weebly.com/uploads/1/3/1/4/131438847/5561979.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/sazomo/acupressure_points_in_human_body.pdf
    • https://uploads.strikinglycdn.com/files/5e0a8b2a-cf25-427e-9c08-e4a2f119bc55/2000_polaris_trailblazer_250_carburetor_adjustment.pdf
    • https://uploads.strikinglycdn.com/files/4d315561-b056-41b1-83e3-d1ee7dc86400/a_mindful_year_365_thoughtful_writing_prompts.pdf
    • https://uploads.strikinglycdn.com/files/8ef314a0-8711-4795-93b3-5956fb73188b/handmaids_tale_season_1_free_streaming_online.pdf
    • https://uploads.strikinglycdn.com/files/2299ff0e-4966-471a-ba70-042da3b6921d/29373101727.pdf
    • https://s3.amazonaws.com/bipepezuwed/kolapa.pdf
    • https://uploads.strikinglycdn.com/files/13516c41-e7b7-43d6-a295-b78b0ee52c3c/energizer_nimh_battery_charger_chp42us_manual.pdf
    • https://s3.amazonaws.com/bisapovepizaj/jumexexuzumavemugarugus.pdf
    • https://s3.amazonaws.com/bofake/excel_home_finance_spreadsheet.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f119.bin
13afdab2501fb7070fdaa4419940fd034a0468aa2e0165b075b9632edbda52eb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF119 98728 bytes
font_01_sfnt_off00021703.bin
2dc55f0f5affb2bb22b8adb30a909ec9e93f9cba88ce6ccf05334956f853b32a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x21703 5580 bytes
font_02_sfnt_off000229f2.bin
b9cc8a06e4311372e9bb7141d2d66816a6e3b64ff2fb159dafc266bfcbacc099		 pdf-font-stream PDF embedded font (sfnt) at offset 0x229F2 11396 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.