Malicious PDF — malware analysis report

Static analysis result for SHA-256 9e72de2a1e6ca2e9…

MALICIOUS

PDF

62.6 KB Created: 2021-02-06 06:21:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 9e8cc73a51193fb5b2b7f345129995bf SHA-1: 65b488353ced58d6c795a556f91ed72db0ae8c7c SHA-256: 9e72de2a1e6ca2e91d96fccc4371582506e7a43a54f61a9dbebf69b4f12d550a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a URL that is disguised as a data sheet, likely to trick the user into visiting it. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest it's designed to lead the user to a malicious resource, potentially for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wb?keyword=argon%20welding%20gas%20data%20sheet PDF link annotation
    • https://cdn.sqhk.co/sajixobuko/wiahdhi/36043128674.pdfIn PDF document text
    • http://granitmetrospecstroy.ru/arkham_horror_rules_reference5vcsi.pdfIn PDF document text
    • https://cdn.sqhk.co/lituxopevuk/tidgoie/taxapoxaxumebefejewifip.pdfIn PDF document text
    • https://cdn.sqhk.co/xexisini/jc5ihjh/sodugosig.pdfIn PDF document text
    • http://tamakar.tech/definicion_de_andragogiak7pnz.pdfIn PDF document text
    • https://cdn.sqhk.co/vakanaju/UJhh2AP/american_football_field_goal_distance.pdfIn PDF document text
    • https://cdn.sqhk.co/lazujanaziri/jibjjrP/87272227874.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4407552/normal_5fc84221acf4c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4380226/normal_600080169f098.pdfIn PDF document text
    • https://cdn.sqhk.co/xelalizogim/aJMyUgh/dune_2020_cast_feyd.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://putazosaw.epizy.com/foxob.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b755.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB755 5168 bytes
SHA-256: 51b527a5b1bb890fd806f77ef52abbd841baff71287cf490da9ebe5c5bdbc119
font_01_sfnt_off0000c8f0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC8F0 10464 bytes
SHA-256: 36862c867217af76a89b51024fa173e492bed7c6a9796a6bbc4fe6542d192d54

Open this report in the interactive analyzer, or submit your own file for analysis.