Malicious PDF — malware analysis report

Static analysis result for SHA-256 9f60dcd6e1a18e2a…

MALICIOUS

PDF

85.4 KB Created: 2021-05-02 03:43:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: a89cb7d520e640d0cb5293b3a71c513c SHA-1: 2c48a0ee274ddf74055ed7073b7f01c482b7c3b9 SHA-256: 9f60dcd6e1a18e2a0505f9c69338cc98ec6299a119fa3196de58b25ae865bb3c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL leading to a suspicious domain. The document body, though heavily obfuscated, appears to be a lure related to the URL's query parameter. ClamAV and ML classifiers strongly indicate maliciousness, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/strik?utm_term=is+it+bad+to+walk+alone+at+night PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4484154/normal_605689ed9c1ed.pdfIn PDF document text
    • https://kitenogoxaginup.weebly.com/uploads/1/3/5/2/135298643/menurifipenavap.pdfIn PDF document text
    • https://norotenivepele.weebly.com/uploads/1/3/4/0/134042349/8363887.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454684/normal_5ff1b3899181d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4453098/normal_604dc3d0e3749.pdfIn PDF document text
    • http://kobasobapina.22web.org/butterfly_life_cycle_writing_template.pdfIn PDF document text
    • http://foxinawolukomat.iblogger.org/mirufiluxiwuwube.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4461523/normal_603c836dc3bd4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4474734/normal_6001213da82fc.pdfIn PDF document text
    • http://fosavaxenu.mypressonline.com/digital2_tablet_battery_replacement.pdfIn PDF document text
    • https://bozobamawokoruv.weebly.com/uploads/1/3/4/3/134350924/duzijiben-goxiwedajatomib-kijonefutoxe-gifuditogam.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/zabevog/agriculture_biologique_en_algerie.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a9d89256-78e5-44a4-9803-11c8c7863851/nopivo.pdfIn PDF document text
    • http://sonarubitexo.atwebpages.com/xukarutosunowixa.pdfIn PDF document text
    • https://s3.amazonaws.com/forupokisip/nerasarokevurinali.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/02ac3c2e-dada-467c-88d7-cd8ac07de6a2/civil_engineering_drawing_book_by_v_b_sikka_free_download.pdfIn PDF document text
    • https://s3.amazonaws.com/veledabejufi/ar_blue_clean_ar383ss_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0b1f3589-9a0e-44da-b795-cd591a4e5486/comedy_drama_script_in_hindi_free_download.pdfIn PDF document text
    • https://s3.amazonaws.com/jipowumat/chinese_landscape_wallpaper_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/49040b11-fe91-4749-bea9-c4d95086ebbf/24611467004.pdfIn PDF document text
    • https://s3.amazonaws.com/tevigotu/cbre_report.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/215cbc32-c3d0-4c6a-bddc-582545592464/57909688942.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010ed0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10ED0 5224 bytes
SHA-256: a8194d7ad65f53ae0e7ab3905a55031fae6f108398fc51b5299aa7f5952d529c
font_01_sfnt_off000120a4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x120A4 10944 bytes
SHA-256: c63a45a821a278f5753442a2412e81de92c4b509b198d56d9443f536bfa55adf

Open this report in the interactive analyzer, or submit your own file for analysis.