Malicious PDF — malware analysis report

Static analysis result for SHA-256 a4c1483b8521d969…

MALICIOUS

PDF

107.4 KB Created: 2021-04-01 13:49:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 815f36298475832f23b93970a487bad9 SHA-1: 7944e4bbf395b12d670d8bb5c99d074dadc7a115 SHA-256: a4c1483b8521d9699dd602a727504aab459848cd63aa857988c2ba4e0d9f7239
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a URL that mimics a job search query, suggesting a phishing lure. While no scripts were explicitly extracted, the PDF structure and embedded URI strongly indicate an attempt to redirect the user to a malicious site for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/wix?keyword=hudson+county+schools+of+technology+employment
    • http://mail-autoscout24.net/dungeoning_idle_dungeon_crawler_modtd7e5.pdf
    • http://vashmaster.info/how_to_determine_change_in_position_from_a_velocity_time_graphq73fa.pdf
    • http://stavki.link/nature_beautiful_hd_wallpaper43ix2.pdf
    • http://mivetys.xyz/60050399433l04ge.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/74cde827-a2a1-4e48-998d-693fbb4ef7a7/dds_discount_hours.pdf
    • https://s3.amazonaws.com/vuforewebub/nisomonifutexifuviwojig.pdf
    • https://s3.amazonaws.com/teximikamukubo/how_to_define_climate.pdf
    • https://s3.amazonaws.com/mokuwanibof/nepafuje.pdf
    • https://s3.amazonaws.com/zuguvoxoki/think_and_grow_rich_the_legacy_2017.pdf
    • https://uploads.strikinglycdn.com/files/1021c0c6-317f-4ece-ba3e-8ef6fea874de/how_do_you_trace_a_long_lost_friend.pdf
    • https://s3.amazonaws.com/jixeremipet/pudawemuw.pdf
    • https://uploads.strikinglycdn.com/files/490a2c01-1ba0-4eb5-ab7d-8417edb7b765/16126695639.pdf
    • https://uploads.strikinglycdn.com/files/3c5aaab9-0b03-4c5c-8666-18fb6fd44521/94371993284.pdf
    • https://uploads.strikinglycdn.com/files/42526abc-5275-48ff-8b1f-30bb99a3299c/how_to_turn_on_dyson_v6_absolute.pdf
    • https://s3.amazonaws.com/vutame/laminate_sheets_for_sale_adelaide.pdf
    • https://uploads.strikinglycdn.com/files/9f852eef-d2ad-408b-b142-5e001c9ba7d7/suwajewelasopom.pdf
    • https://uploads.strikinglycdn.com/files/9cae1559-4c40-42c0-946f-9a3c90b68474/gataso.pdf
    • https://uploads.strikinglycdn.com/files/83ede8f2-6787-4531-b3b8-fe105c7ee6ed/bosozewoduboreju.pdf
    • https://s3.amazonaws.com/kumasala/armitron_watch_manual_45_7041.pdf
    • https://uploads.strikinglycdn.com/files/1e6effa5-1275-4558-9e0a-eb9159223663/stress_management_lesson_plans_high_school.pdf
    • https://uploads.strikinglycdn.com/files/a143e240-395f-4b71-a8e7-e1031943c6a2/zixotilitejevoxefeviro.pdf
    • https://uploads.strikinglycdn.com/files/574ed665-0d71-48b6-b751-014168168285/garmin_93sv_vs_94sv_vs_95sv.pdf
    • https://uploads.strikinglycdn.com/files/4808143f-37b5-48a6-bd72-eec7ef920b63/58712298648.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00015008.bin
ede449e6968bd172b553028aefd1a47709cadb5a4ff58b084f12655282d7067d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15008 5328 bytes
font_01_sfnt_off00016218.bin
1e6e2709bb333518377fc0a58388b478d907c0a1c2a327573724af13f738559f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16218 11216 bytes
font_02_sfnt_off0001882a.bin
1c2d7b51a53df8709e4815dbf62dc11714cf0ad45a09eec1ff6f34786565b069		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1882A 16728 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.