Malicious PDF — malware analysis report

Static analysis result for SHA-256 a24a089fd323829f…

MALICIOUS

PDF

73.9 KB Created: 2021-03-16 17:15:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2856c354ed3f91ff706f771589cbbe90 SHA-1: 73d2ac16907c75fe6388f98128bc5d20f2009482 SHA-256: a24a089fd323829fd9d757fe2a2591f384cbb39b0372778d753162a038374b2d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a website designed to appear as a search result for a specific product. This is a common phishing tactic to trick users into visiting a malicious site. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/wix?keyword=medela+manual+breast+pump+target
    • http://antonioit.fun/breeds_of_sheep_in_nigeriajw2hp.pdf
    • http://popubim.iblogger.org/jokajizukuniguzimegugu.pdf
    • http://gisoboxizaza.mygamesonline.org/greenworks_20-inch_12_amp_corded_lawn_mower_25022_canada.pdf
    • http://paktum.pro/folk_and_popular_culture_frqh43su.pdf
    • http://xajabuzowa.scienceontheweb.net/46107187799.pdf
    • http://fadulifakibul.medianewsonline.com/65055532126.pdf
    • http://kigetipopizatij.getenjoyment.net/air_fryer_recipes_south_africa.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/81c479c7-3c2c-4bd4-9e00-814311b3f0e7/zezalono.pdf
    • http://xenemusexo.epizy.com/hamlet_william_shakespeare_characters.pdf
    • http://xutenasejubibe.atwebpages.com/autoestima_tipos.pdf
    • http://saluwagasa.onlinewebshop.net/declaration_of_income_assets_and_liabilities_form.pdf
    • https://uploads.strikinglycdn.com/files/5728e373-15b3-432e-855f-23572c4b51e6/85803460437.pdf
    • http://bodegifu.atwebpages.com/remington_pole_saw_repair_parts.pdf
    • https://uploads.strikinglycdn.com/files/0d89482a-b183-4171-81fd-e82684b2f133/what_is_the_importance_of_waste_management.pdf
    • http://luxupuxud.myartsonline.com/subtraction_with_borrowing_worksheets.pdf
    • http://tevaluzax.atwebpages.com/breviario_romano_latin_espaol.pdf
    • http://bagugexasorip.myartsonline.com/12535133443.pdf
    • http://wenakukifitazo.rf.gd/langston_hughes_poems_about_race.pdf
    • http://lawesiwewif.onlinewebshop.net/magic_tree_house_book_series_age_group.pdf
    • http://xotivigafutuzul.epizy.com/xazamugovuviboxamupi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e357.bin
cdba2da17eac5a7f439c86b54205e0ac630363fad7ca143856d6891f1bb5bf03		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE357 5424 bytes
font_01_sfnt_off0000f5b5.bin
ea579272f4a2235af171f957167db447df8b9f27bc2f9f7a95c71f85a57695a3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF5B5 10328 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.