Malicious PDF — malware analysis report

Static analysis result for SHA-256 a1a624f80e161310…

MALICIOUS

PDF

70.0 KB Created: 2021-05-11 04:02:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 016803a68ebbee9cb73b625d290e8b83 SHA-1: 144044bf4e5678e24770c05e0dfd5da277c3b63c SHA-256: a1a624f80e161310627b02a9be80022fd8ef4007eef2a8c9fe9864056787fe62
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains embedded URLs that likely lead to further malicious content, suggesting it acts as a lure to download a second-stage payload. The document body is heavily obfuscated, preventing a clear understanding of its immediate purpose beyond the embedded links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://constructionone.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16077e6c14c5e0---90467253245.pdf
    • https://www.varisistanbul.com/wp-content/plugins/formcraft/file-upload/server/content/files/160822fe769037---zajavozemolobis.pdf
    • https://diversified-nj.com/wp-content/plugins/super-forms/uploads/php/files/adcf590434d6e0a97dfdae9b3eb23460/nuvevavadajo.pdf
    • http://paillasse.hu/userfiles/file/53354091011.pdf
    • http://www.sunarpazarlama.com/wp-content/plugins/super-forms/uploads/php/files/b94jbh7b0iv98pu2aravql2u87/10768186149.pdf
    • https://autosofortkauf.ch/wp-content/plugins/super-forms/uploads/php/files/90b4k8h71l020vnkc03bh37pol/43733111031.pdf
    • http://www.whirlpool-beachcomber.at/wp-content/plugins/formcraft/file-upload/server/content/files/1608b54044497c---99427648943.pdf
    • http://megat.pl/uploaded/fck_files/file/wogadufavoja.pdf
    • https://prikolnaya.com/wp-content/plugins/super-forms/uploads/php/files/e2a75551658a4faf2ad5d2ea96050956/2026856782.pdf
    • http://zawayakw.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606ca5cb49706---tipufapej.pdf
    • http://accessprecision.com/userfiles/file/jozifizabexo.pdf
    • http://automsystem.com/UploadFile/file/20210508071723173.pdf
    • https://photographerin.agency/wp-content/plugins/super-forms/uploads/php/files/hh56cv2mefuh13smr2jhiugg32/89597545848.pdf
    • http://grani-tonkogo-mira.ru/wp-content/plugins/super-forms/uploads/php/files/e1240aa493a12455b814f2af896e0685/tovixi.pdf
    • https://www.fmworks.com.tr/wp-content/plugins/super-forms/uploads/php/files/p44qkcflvb105kmtgnfqhoktni/nenetezixinalerape.pdf
    • https://zazilha.com.mx/wp-content/plugins/super-forms/uploads/php/files/8aa5fda9ff7f0a23f1434f6a9a164662/finotawoboguke.pdf
    • https://reifenscho.de/wp-content/plugins/formcraft/file-upload/server/content/files/16076f41ced587---batagukut.pdf
    • https://ifacemount.com/wp-content/plugins/super-forms/uploads/php/files/ssgnja9vb3akfancusq5ft0flb/45167367538.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/skout/mBVl/~3/BvfzZFkJO3s/uplcv?utm_term=remote+shutter+camera+360+ios+android
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d3ba.bin
398fc748e3908d9407d951f02d54601d2bdd02d456d16ec42b599c2d26beffcf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD3BA 5616 bytes
font_01_sfnt_off0000e6a1.bin
47883b2eef96f07c0991a58fc64dd32c6e23762b9c056b11ebbefb2f68a1538b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE6A1 10608 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.