Malicious PDF — malware analysis report

Static analysis result for SHA-256 a1cca78eecc08692…

MALICIOUS

PDF

107.2 KB Created: 2021-03-09 13:59:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8f41f3461dbb6fce46727a4d60fc084c SHA-1: dc811048683752154fb80cdfc043e2515879c104 SHA-256: a1cca78eecc08692ef96483afac1afcabff8976e4b58681330275593aef27ce3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL, identified as a phishing lure. The ML classifier and ClamAV detection strongly indicate malicious intent. The presence of an external URI suggests the document is designed to redirect the user to a potentially harmful website, likely for credential harvesting or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=almach+artist+information
    • https://danupinizagene.weebly.com/uploads/1/3/1/4/131483344/zolobugazevo-kumofogagil-potib-vobujedinegided.pdf
    • http://sawedes.mywebcommunity.org/how_to_put_in_a_keurig_water_filter.pdf
    • https://xufaxasevejanog.weebly.com/uploads/1/3/4/8/134886042/7347412.pdf
    • http://beririka.scienceontheweb.net/char_broil_performance_2_burner_gas_grill_manual.pdf
    • http://segaruzobuguses.scienceontheweb.net/17587808511.pdf
    • http://gizigevom.mygamesonline.org/charlie_and_the_chocolate_factory_1971_full_movie_dailymotion.pdf
    • http://vowujebotoza.mywebcommunity.org/runa_vimochana_angaraka_stotram.pdf
    • https://zobegutibeg.weebly.com/uploads/1/3/4/9/134902349/1993675.pdf
    • http://dotixomovi.sportsontheweb.net/why_does_my_whirlpool_washer_not_start.pdf
    • http://sosiwawivijomo.scienceontheweb.net/infinix_note_4_x572_price_in_kenya.pdf
    • https://risimapi.weebly.com/uploads/1/3/4/3/134321435/keduropizima_niruxunijak.pdf
    • https://jimekomu.weebly.com/uploads/1/3/1/4/131453536/2871137.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://zegetafirotazaz.atwebpages.com/nimiwesadolukasukupuzuf.pdf
    • https://s3.amazonaws.com/napisakaluja/41232514509.pdf
    • https://s3.amazonaws.com/bagisi/amd_a4-_6300_network_driver.pdf
    • https://s3.amazonaws.com/bededuxotulapil/14214529166.pdf
    • http://tixinova.rf.gd/36286323267.pdf
    • https://s3.amazonaws.com/verirejon/44679218979.pdf
    • http://posufimiru.rf.gd/in_case_of_emergency_excel_template.pdf
    • https://s3.amazonaws.com/pubopelej/akira_2016_full_movie_300mb.pdf
    • http://dovunufesesiz.onlinewebshop.net/78065430001.pdf
    • http://kujugomanata.rf.gd/iron_man_3_theme_violin_sheet_music.pdf
    • http://kugukokoner.myartsonline.com/wetirigirexafimo.pdf
    • http://zosofoladi.rf.gd/wasajodexowabijuraluf.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000166f4.bin
15a385e5e65cbfa5ebbfe6632e39ad4d93dcddb4f8b927a3955910b1be91c947		 pdf-font-stream PDF embedded font (sfnt) at offset 0x166F4 5112 bytes
font_01_sfnt_off00017824.bin
db3121c2c4ed8138b906e62072aebe23daa51b305abb8eb4f1430b1b2d8af7fa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17824 11700 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.