Malicious PDF — malware analysis report

Static analysis result for SHA-256 a56f0367db0acb27…

MALICIOUS

PDF

70.6 KB Created: 2021-02-23 11:14:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-07
MD5: 66c88a778428fac3516f448a815ce329 SHA-1: 7575b20851acbaf99aeb7ac7d548c0d55df4a92d SHA-256: a56f0367db0acb273199679f13a66b2e594c26d586aeeacd6234fba09e05229f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. The embedded URL and the document body suggest a lure for downloading content, which is a common phishing tactic. Although no scripts were explicitly extracted, the PDF format can embed JavaScript for malicious actions, and the presence of external URIs points towards a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/strik?utm_term=asmaul+husna+free+download+video PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4369907/normal_5fce2962001e4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4485457/normal_5ffa68d208948.pdfIn PDF document text
    • http://baranaydin.org/palepagezevoduwik8r4f.pdfIn PDF document text
    • http://tortomsk.ru/nuby_manual_breast_pump_bootsmn9r0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4477409/normal_6033c50a6536b.pdfIn PDF document text
    • http://espaceclient-cmb.com/keurig_2.0_manual_troubleshootingltfyt.pdfIn PDF document text
    • http://form-lnstagramverifiedbadges.com/fapizawojilevaxu0y9es.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4460449/normal_5fca964a9ff35.pdfIn PDF document text
    • https://cdn.sqhk.co/nisisepolo/ihATqrt/nonozugekabaralilotafov.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4421366/normal_60065330e70b3.pdfIn PDF document text
    • https://cdn.sqhk.co/gibuzini/CWwjcw2/judge_judy_age.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4368240/normal_5ff51bc52376d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418178/normal_600de908d2010.pdfIn PDF document text
    • https://cdn.sqhk.co/mepetiruzi/gJjgDXe/cake_cutter_set_wedding.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://rubijisezet.epizy.com/vukepomuwekubeni.pdfIn PDF document text
    • http://bireses.rf.gd/97015021461.pdfIn PDF document text
    • http://voxotili.epizy.com/hormone_replacement_therapy_guidelines_canada.pdfIn PDF document text
    • http://fejusadifidexi.epizy.com/bazexomasejujuvetexumipox.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d96d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD96D 5288 bytes
SHA-256: 2dbf411634bf7f823ab4ec98428ca132f9633b1b67b541da2f168a607450d195
font_01_sfnt_off0000eb52.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB52 10052 bytes
SHA-256: 4bde4d7e11df9d95f4869005c1173b98455f28ea1620dccfcf7bb6119f4dce0b

Open this report in the interactive analyzer, or submit your own file for analysis.