Malicious PDF — malware analysis report

Static analysis result for SHA-256 a54d4512d861e980…

MALICIOUS

PDF

84.4 KB Created: 2021-03-16 05:18:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d97e45e096299a3c0bd62f3a19bd298d SHA-1: 2ee5471a99446c6c726ede4f48548e9f57b9236b SHA-256: a54d4512d861e9803794037765360a58628b8172415c848bf362999d390ed5df
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged by ClamAV as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site. The ML classifier also strongly indicated maliciousness. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=old+grading+scale
    • http://pisodanijuke.iblogger.org/garabojejadagabelogabeg.pdf
    • http://zumanidoxup.medianewsonline.com/kipezebabewekobuvuzatudum.pdf
    • http://luxasireku.sportsontheweb.net/norelco_multigroom_5000_vs_7000.pdf
    • http://misstourist.info/riloforaje9wtek.pdf
    • http://mnogoturov.com/types_of_cables_in_networking7it15.pdf
    • https://cdn.sqhk.co/vekosozob/b6klGWg/kubica_f1_crash.pdf
    • https://cdn.sqhk.co/guranotup/i6jm5ic/warhammer_40_000_freeblade_ios.pdf
    • http://grantmedica.ru/fufupukozotuvefocflpd.pdf
    • https://cdn.sqhk.co/zovifesojeme/gijiJgi/irish_road_trip_18_days.pdf
    • https://novigavaze.weebly.com/uploads/1/3/0/8/130874354/2925297.pdf
    • https://fixewanum.weebly.com/uploads/1/3/5/3/135309042/levekoxikezedivomos.pdf
    • http://giwudogor.scienceontheweb.net/xigudis.pdf
    • http://merovew.xyz/7165268275zmzrn.pdf
    • http://demask.space/zuwifepoxem3m3zy.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://2daccc73-8708-4113-a26a-4f38906335d9.filesusr.com/ugd/f65175_9f4c63e09f784078bffd79648d30158c.pdf?index=true
    • https://527ed197-5826-4432-9c89-449afa9d705e.filesusr.com/ugd/65ef70_12453af430e14571b75b78fb1a836f0c.pdf?index=true
    • http://vobikeretuwof.atwebpages.com/lepifoto.pdf
    • http://dirazonun.myartsonline.com/mahindra_tractor_price_list.pdf
    • https://c2bc7a71-cb21-434c-84f6-8d2fc09ed56d.filesusr.com/ugd/03ae60_154d7cc5a40a4ba19d1f5cb22e4c44f6.pdf?index=true
    • https://9e730ba1-499c-413e-9a09-8a81f8121270.filesusr.com/ugd/0a0016_1d7fe4014d264b1388ed7bcc6cd0f123.pdf?index=true
    • http://monufaro.epizy.com/ana_maria_barrenechea.pdf
    • https://700ceb37-22d2-47c5-9888-d858af679aee.filesusr.com/ugd/c345b0_c54f56ff741141c3a3ed70ecc3e34df8.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010d2d.bin
1b606bd08cd5ddaf09213a47717b9018f808365501f074b6b696f77be2e6f121		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D2D 5132 bytes
font_01_sfnt_off00011eab.bin
d3af0efe5d7b63af4c3afa1f3f3852b7b6abbbd3f5e04585073f5837c6863f5e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11EAB 11148 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.