Malicious PDF — malware analysis report

Static analysis result for SHA-256 a817b8299c70ab1e…

MALICIOUS

PDF

81.5 KB Created: 2021-03-18 14:51:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9a4d401e2d1c1c9d016bfa7c57b80581 SHA-1: 80b55763b1787e54c7622c243d92d674d1b55265 SHA-256: a817b8299c70ab1e8f2a678bc1147b44978ca5d0d12bcc11ee3c34604bcb30ca
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that mimics a search query, likely intended to trick the user into visiting a malicious site. ClamAV and ML classifiers strongly indicate malicious intent, classifying it as a phishing trojan. While no scripts were directly extracted, the PDF structure and embedded URI suggest a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=proctor+silex+slow+cooker+settings
    • http://ilook.market/clock_templateoacsl.pdf
    • http://car-den.ru/webasto_engine_heater_reset0oobi.pdf
    • http://meetsucre.pro/78168252950sy92h.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://lapekekefexe.rf.gd/mukujimogevitino.pdf
    • https://s3.amazonaws.com/gogoxowiniza/rule_of_exponents_worksheet.pdf
    • http://kazaxese.epizy.com/princess_diaries_quotes_joe.pdf
    • http://ferobinosu.epizy.com/buku_belajar_bahasa_jepang_dasar.pdf
    • https://s3.amazonaws.com/satudifin/71962316842.pdf
    • https://s3.amazonaws.com/xalasawu/jaxizuvirese.pdf
    • http://jusolasoxo.epizy.com/anime_girl_drawing_easy_step_by_step_full_body.pdf
    • https://s3.amazonaws.com/vaxebisapesi/bacillus_fusiformis_disease.pdf
    • https://s3.amazonaws.com/wunupalezozerud/photo_id_card_maker_software_free.pdf
    • https://uploads.strikinglycdn.com/files/9dfef0c2-7569-4454-b653-a50a7a9f5989/asus_rampage_v_extreme_usb_bios_flashback.pdf
    • https://s3.amazonaws.com/gagagakigibapo/dichiarazione_asseverata_di_conformit_igienico_sanitaria_milano.pdf
    • https://s3.amazonaws.com/gopuze/28343236905.pdf
    • https://s3.amazonaws.com/tikoweravisixu/how_to_use_bosch_300_series_washer.pdf
    • https://uploads.strikinglycdn.com/files/47609a5f-e55f-48cd-a86c-8e9a7d01ee1b/13520708005.pdf
    • https://s3.amazonaws.com/vitelitubovuluj/dufom.pdf
    • https://uploads.strikinglycdn.com/files/154a8dd3-f20f-4b57-8bfb-779774151b24/madinah_arabic_vocabulary_book_2.pdf
    • http://rojaxenutu.rf.gd/subway_singapore_menu_price_2020.pdf
    • https://s3.amazonaws.com/gidibesuxi/11330504916.pdf
    • https://s3.amazonaws.com/salade/barcelona_vs_real_betis_5-_2.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f57a.bin
96a920ba75f5833a0f5c001f4f74942a4fe73b816c809576a65ced12ba94fd35		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF57A 4772 bytes
font_01_sfnt_off000105ce.bin
667fd58d9ee4562547f3408c66084ebd47bf9951840195561b512345a78e8c3d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x105CE 10872 bytes
font_02_sfnt_off00012a57.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12A57 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.