Malicious PDF — malware analysis report

Static analysis result for SHA-256 a425c92ecc91d469…

MALICIOUS

PDF

74.2 KB Created: 2021-04-08 02:08:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 08185130d1c7366ba2c9030ae5d12ca2 SHA-1: 5b811d1954635458e4259f2ba56aa2a0a67c0522 SHA-256: a425c92ecc91d469938f15e79f8d0b0b0a00703ff773a2b407bc91d8644d5ef2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a lure related to business communication, but the document body is heavily obfuscated. The primary malicious indicator is the embedded URL pointing to a suspicious domain, which is likely used to deliver a secondary payload. ClamAV detection and ML classification strongly indicate malicious intent, consistent with a phishing or trojan delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/strik?utm_term=tipos+de+comunicacion+en+la+empresa+descendente
    • https://cdn.sqhk.co/kosibowo/hjjjSja/niworejolisan.pdf
    • http://jakor.pro/what_were_the_four_main_causes_of_the_great_depressionlehjb.pdf
    • https://cdn.sqhk.co/teketerep/Hcjhe6h/82079624446.pdf
    • https://cdn.sqhk.co/furafurume/8uPXjbV/spiral_ham_recipes_for_thanksgiving.pdf
    • http://zagodutaf.getenjoyment.net/gokibodupox.pdf
    • http://nigavereke.mygamesonline.org/definicion_de_exito_profesional_segun_autores.pdf
    • https://cdn.sqhk.co/kiribikiv/aBjdjii/40705952279.pdf
    • http://zumbayuliya.online/gusigemejafuduitro.pdf
    • http://rubolanir.mypressonline.com/49939733745.pdf
    • http://istra-backwater.ru/71590142719yvcyu.pdf
    • https://cdn.sqhk.co/bitaxukezor/d19jahd/rally_coach_worksheet_template.pdf
    • https://cdn.sqhk.co/pivokazi/ggjagjS/wolivododitasado.pdf
    • http://helplnstagramoffice.com/7857736664pjw05.pdf
    • https://cdn.sqhk.co/xororofomed/Rh3eiir/x_shot_nerf_guns.pdf
    • https://cdn.sqhk.co/rigizisojix/S0HjbGy/36856591245.pdf
    • http://nokiwurugibub.mypressonline.com/36965953140.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://gejizejaniwijef.atwebpages.com/47645261621.pdf
    • https://s3.amazonaws.com/xowasosuf/59755687810.pdf
    • https://s3.amazonaws.com/legobegutulo/70068576702.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e454.bin
4aee04564c649347587698ff63a3f2110673c5fc5689855450adab13f639c8a2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE454 5168 bytes
font_01_sfnt_off0000f5cb.bin
475c91efe094400a54dd3112cd2ce402feae13f0cc4570a19e34f3f303d9d727		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF5CB 10992 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.