Malicious PDF — malware analysis report

Static analysis result for SHA-256 a72cbc699a4bf8a0…

MALICIOUS

PDF

80.6 KB Created: 2021-03-20 21:50:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a09f43fb2c3437aecf5b6150bd0e937c SHA-1: a23b66b22e9fd201801305807e9d068cd457d9d9 SHA-256: a72cbc699a4bf8a066a48cb1cc166136032e4c0e58cb36872a6059cb2c74947d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. The document contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site. Although no scripts were explicitly extracted, the presence of embedded URLs and the overall detection profile suggest a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/wix?keyword=pseudocode+interview+questions+and+answers
    • http://vevaxogejaz.scienceontheweb.net/materi_training_apqp.pdf
    • https://static.s123-cdn-static.com/uploads/4421983/normal_5fecaeca5a7cf.pdf
    • https://static.s123-cdn-static.com/uploads/4411717/normal_5fcf1a177507f.pdf
    • https://libexezelidod.weebly.com/uploads/1/3/1/4/131454359/284675.pdf
    • http://kuliwegi.sportsontheweb.net/2008_honda_accord_ex_maintenance_schedule.pdf
    • http://tevituvodejifep.mywebcommunity.org/agro_ecological_zones_of_bangladesh.pdf
    • http://gajozemexip.22web.org/87302239726.pdf
    • http://jalazekesofijot.medianewsonline.com/kedaripolupewitadewoje.pdf
    • https://static.s123-cdn-static.com/uploads/4420260/normal_5fc7ffad0a350.pdf
    • https://xanikijopido.weebly.com/uploads/1/3/4/7/134738407/delokujuraseno.pdf
    • http://bumasujofoj.getenjoyment.net/operations_management_jobs_columbus_ohio.pdf
    • https://static.s123-cdn-static.com/uploads/4407299/normal_6000be639514f.pdf
    • https://vevumugenewasu.weebly.com/uploads/1/3/0/7/130776279/zureriwunimo.pdf
    • http://mojenisijita.mywebcommunity.org/is_there_a_killing_floor_3.pdf
    • https://static.s123-cdn-static.com/uploads/4376374/normal_5ffcaf4884ab8.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/96e2ba0f-8ed3-42fd-9fd1-ea90f05f919d/gokefu.pdf
    • http://welilejaw.epizy.com/como_hacer_un_diagnostico_ambiental.pdf
    • http://tipokeviti.atwebpages.com/maximus_memphis_tn_jobs.pdf
    • https://uploads.strikinglycdn.com/files/5a36e08c-2345-47c7-801d-a7cca889dd91/jigutisuxezuregali.pdf
    • https://uploads.strikinglycdn.com/files/bca01808-33a2-405b-9839-9e4931794bb7/90376870560.pdf
    • http://miganuvag.myartsonline.com/air_brake_test_procedure.pdf
    • https://uploads.strikinglycdn.com/files/e585a11f-bae2-4fec-bd6e-6cb36b44991f/68786061269.pdf
    • http://tipipigi.atwebpages.com/bovodabu.pdf
    • https://uploads.strikinglycdn.com/files/b685355a-c04b-40f0-8d52-15b5ad000a50/sitireme.pdf
    • http://fatofejeripise.rf.gd/cambio_climtico_2020.pdf
    • http://kovemipenege.rf.gd/imovie_templates_ios.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010040.bin
9da0f478c23f105d8eb1a4dc4362921244013a976f28888c37c57943234eec9b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10040 5180 bytes
font_01_sfnt_off000111ff.bin
21e03e69995e09ac1d5909bf29b0903a56f12ee6864a0af2ca4f92ea5d55f4ea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x111FF 10764 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.