Malicious PDF — malware analysis report

Static analysis result for SHA-256 a7e3c1ab31bc1fb1…

MALICIOUS

PDF

66.5 KB Created: 2021-05-07 00:28:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: d5cae79d82914895e75ffe05a5b7592e SHA-1: 6a013775e9903df7f7f22d9a8aa82b6632d48772 SHA-256: a7e3c1ab31bc1fb11140b61c15c745bddc070c8325cc83dcd1e77edfbfbe9ab9
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a suspicious domain. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware distribution. The document body, though partially corrupted, suggests a lure related to data interpretation, which is used to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=how+to+interpret+area+chart PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4447906/normal_5fcf33dd91589.pdfIn PDF document text
    • http://table-wait.com/osha_safety_and_health_regulations_for_construction_29_cfr_19269ijuj.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4406168/normal_601ce0df2a47d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417805/normal_5ff9f877a2194.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485156/normal_6036c87d8d133.pdfIn PDF document text
    • http://requiremcgood.com/throne_of_glass_series_book_1_read_online49bzu.pdfIn PDF document text
    • https://cdn.sqhk.co/fezifoxunif/didohia/call_of_winter_war_modern_strike_gun_shooters.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4365598/normal_5ff14f874749e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4457586/normal_5fef6ab66935f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4427085/normal_5fef7944849ab.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380211/normal_60666630656e8.pdfIn PDF document text
    • https://cdn.sqhk.co/surudije/gihihbB/splash_mountain_song_change.pdfIn PDF document text
    • http://digitaltoolsfor.xyz/80258164891p8867.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/fefurorobumi/defending_jacob_ending_explained_book.pdfIn PDF document text
    • https://s3.amazonaws.com/fofeguj/43443422189.pdfIn PDF document text
    • https://s3.amazonaws.com/widiku/answer_my_math_word_problem_free.pdfIn PDF document text
    • https://s3.amazonaws.com/jopomodilamego/26270760368.pdfIn PDF document text
    • https://s3.amazonaws.com/dovulavavo/uniform_store_center_city_mall_paterson_nj.pdfIn PDF document text
    • https://s3.amazonaws.com/gagagakigibapo/international_athletics_score_sheets.pdfIn PDF document text
    • https://s3.amazonaws.com/werowibovezoje/what_makes_something_taste_gamey.pdfIn PDF document text
    • https://s3.amazonaws.com/dukavunivifa/49255532138.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c952.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC952 4864 bytes
SHA-256: 7703952d4bed8091e360653b23f94a0484f2722b1e1d8e29178a103edb1c9f0b
font_01_sfnt_off0000d9e7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD9E7 10184 bytes
SHA-256: 9021f7e17266e7b14b89c348eaacde2edda822423e164a2591e6491d5fe25ad5

Open this report in the interactive analyzer, or submit your own file for analysis.