Malicious PDF — malware analysis report

Static analysis result for SHA-256 9e1aefb7bcf8bea1…

MALICIOUS

PDF

77.1 KB Created: 2021-04-21 19:05:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 7fe0180e321b1b3e29ab9d139c4e756a SHA-1: 708db20651de7aece21cc9177ead047deb611d07 SHA-256: 9e1aefb7bcf8bea1d27efd4800b4097137eff9be953c70865da7bfdb611273b9
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. The document body, though heavily obfuscated, contains text fragments that may be part of a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=d+and+d+automotive+clevedon PDF link annotation
    • http://lizowaw.scienceontheweb.net/adverbs_of_frequency_esl.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373016/normal_5fd87aea60837.pdfIn PDF document text
    • http://hookup671.site/ti_84_plus_c_silver_edition_batteryugnde.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370054/normal_601cc298f079c.pdfIn PDF document text
    • http://kuwawaf.mypressonline.com/cohesion_and_adhesion_of_water.pdfIn PDF document text
    • http://wedipum.mygamesonline.org/games_like_baldurs_gate_dark_alliance_2_for_ps4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4457298/normal_5ff19a719650e.pdfIn PDF document text
    • http://b0xberry.online/fikinagifa6963g.pdfIn PDF document text
    • http://stavki-na-sport.site/nesimijawobiltq791.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/divexikav/rusuwerezutekanejer.pdfIn PDF document text
    • https://s3.amazonaws.com/popisiburewixuj/sodutugavigi.pdfIn PDF document text
    • https://s3.amazonaws.com/zaxefemebidaz/angular_4_admin_template_themeforest.pdfIn PDF document text
    • http://vogapodidojuguf.myartsonline.com/xepizotubibo.pdfIn PDF document text
    • https://s3.amazonaws.com/tugafebip/how_much_will_gamestop_give_me_for_ds_games.pdfIn PDF document text
    • https://s3.amazonaws.com/limepusotanal/how_to_fix_my_paper_shredder.pdfIn PDF document text
    • https://s3.amazonaws.com/baxekojojexusol/biology_20_textbook_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/donukadizolin/jigobudaxizotutetufemuwon.pdfIn PDF document text
    • https://s3.amazonaws.com/zesotat/govavotadifutalobuxuxagu.pdfIn PDF document text
    • https://s3.amazonaws.com/xamapebonijos/cfpb_complaint_database.pdfIn PDF document text
    • http://zisukuvi.atwebpages.com/business_environment.pdfIn PDF document text
    • http://gevejonitu.onlinewebshop.net/how_to_quick_ratio_analysis.pdfIn PDF document text
    • http://gudugapapilile.atwebpages.com/tozemobufasuf.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e2aa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE2AA 4752 bytes
SHA-256: 87d0be0d2192839596493b30557baaef0cc09d9f37cac536177955cc2f669c2a
font_01_sfnt_off0000f2c0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF2C0 11180 bytes
SHA-256: 15e590529db58aa962f0cc3682b795cd29938bfd4c9f94236aacc65b1965fab0
font_02_sfnt_off00011902.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11902 4324 bytes
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34

Open this report in the interactive analyzer, or submit your own file for analysis.