Malicious PDF — malware analysis report

Static analysis result for SHA-256 a82a6a079815f79f…

MALICIOUS

PDF

75.4 KB Created: 2021-04-05 08:17:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8da20cf177b1cc928bb786fe4a9322df SHA-1: a3a7c8dbc7e5182a15b07b1383a0fbfae6836c18 SHA-256: a82a6a079815f79f3ea75b810b29afae140f1fdb275a4548f9581f2d9ace91b6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. The document body is heavily obfuscated, but the presence of the external URI suggests a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=d%2526d+5e+xanathar%2527s+guide+to+everything+classes
    • http://4bochki.ru/how_many_quarts_of_oil_does_a_2003_6.0_powerstroke_takevo40w.pdf
    • http://kinorio5.xyz/resident_evil_4_36_trainerwpa7m.pdf
    • https://cdn-cms.f-static.net/uploads/4451753/normal_600ecaf06a8bd.pdf
    • http://meetchambre.xyz/11208274140zs15v.pdf
    • https://static.s123-cdn-static.com/uploads/4419205/normal_5fed673199825.pdf
    • http://laulu-go.ru/10754229907geoa9.pdf
    • https://fevokixesebu.weebly.com/uploads/1/3/0/7/130776230/figofed.pdf
    • http://mivetys.xyz/can_you_pair_two_ue_boom_speakersocj46.pdf
    • https://kiwitelovig.weebly.com/uploads/1/3/4/3/134358902/wepitupawora-xeziroboje-rologinusikaw.pdf
    • http://mbfsopg.com/dot_safety_rating_upgradeb0z3m.pdf
    • https://static.s123-cdn-static.com/uploads/4456369/normal_5fc80b4cc2fa5.pdf
    • https://zaxixeresez.weebly.com/uploads/1/3/1/8/131871416/1639835.pdf
    • https://cdn-cms.f-static.net/uploads/4478387/normal_6029b1a7b8e1a.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://f4b9ed98-44c1-44e6-9966-d9817cd43de7.filesusr.com/ugd/9ced5d_76af47879c77428ebbf9785553fac4cd.pdf?index=true
    • http://falowowujozaba.rf.gd/tiduluwodunolofe.pdf
    • https://d4f4546a-a836-4b3d-8651-c56b89608eca.filesusr.com/ugd/3e9e83_184f7d7455ad45479974c583efc2ca3c.pdf?index=true
    • https://f110cc6a-49d6-427c-9ab6-a3a4d323b004.filesusr.com/ugd/9e53d4_abf6b4d327cb42cd88ffa407a580f84c.pdf?index=true
    • https://5efcf519-4c71-4be9-a00f-e1d47ba804c5.filesusr.com/ugd/ebcc4b_37fb684496ff42828b602d3dd8c00b44.pdf?index=true
    • http://romevakamijoke.epizy.com/fitbit_versa_lite_smart_fitness_watch.pdf
    • http://lipaxunuvevi.epizy.com/what_is_an_ideological_statement.pdf
    • https://769966b8-4adc-437e-bba8-f198cf6e171b.filesusr.com/ugd/41a0b6_21c12a57759e454f8130612059cad2a6.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee8d.bin
d9d9eb8b5a67a8494ca5a9593d54773c41ba913a17cb426b52e0a193c0b11448		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE8D 4156 bytes
font_01_sfnt_off0000fcbb.bin
74b46d3fb6d42a1016a39fb75d8eec66c46a634a485f31860e8f8bdc0b56eea7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFCBB 10656 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.