Malicious PDF — malware analysis report

Static analysis result for SHA-256 a130da58feb1d7a7…

MALICIOUS

PDF

74.9 KB Created: 2021-04-01 19:14:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 6cb3564e4abe2187ff05327b1ae8c5bd SHA-1: 2910c61a9122fc605c1b3dcfea3a622cb1d6501b SHA-256: a130da58feb1d7a7d048f194c060a45866da8475d2deef4ffaea5dd8ae82c75c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL. The ML classifier and ClamAV detection strongly indicate maliciousness, with ClamAV identifying it as a phishing trojan. The document body, though heavily obfuscated, suggests a lure related to academic material to entice users to click the embedded link, which likely leads to a malicious payload or phishing site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/award?keyword=introduction+to+plant+ecology+pdf PDF link annotation
    • http://lolkek.xyz/wavefront_obj_models_freeys27x.pdfIn PDF document text
    • http://static-start.top/injury_on_duty_report_form6b92i.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4411694/normal_60170b0345dae.pdfIn PDF document text
    • http://delayikapy.xyz/934654345417fsdq.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4485161/normal_5fc5843585cd6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4427783/normal_5fe4221b23378.pdfIn PDF document text
    • http://axecheat5.xyz/angel_care_baby_monitor_ac401_beepingvy0v9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4487918/normal_604ca042c1901.pdfIn PDF document text
    • https://gokivasinu.weebly.com/uploads/1/3/4/3/134334496/gowamujukoled.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4413362/normal_5fdee5bbc46e5.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4493569/normal_6007db46c5433.pdfIn PDF document text
    • http://vamoktin.ru/telavef0uqr3.pdfIn PDF document text
    • https://jaketomerinojox.weebly.com/uploads/1/3/4/1/134109184/debogeg.pdfIn PDF document text
    • http://smcjd.com/jaxopafapedafabivuyrwrv.pdfIn PDF document text
    • http://handler-autoscout24.com/591351780596nukc.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/pujinit/25393166969.pdfIn PDF document text
    • https://s3.amazonaws.com/sepawi/74245991152.pdfIn PDF document text
    • https://s3.amazonaws.com/zarevizebi/pixikefonadiloretigobovup.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e89e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE89E 5184 bytes
SHA-256: 44e0ea9b5c5db8d2ad417906b393b3310915b8180979c16aeea55e649b06ed2b
font_01_sfnt_off0000fa5d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA5D 10620 bytes
SHA-256: 02e6533db0a4b0e13ebded2647d7682d94605b483f2110e4a8e4cf8305d34d1b

Open this report in the interactive analyzer, or submit your own file for analysis.