Malicious PDF — malware analysis report

Static analysis result for SHA-256 a88896155f519b44…

MALICIOUS

PDF

81.3 KB Created: 2021-04-01 20:42:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 6e5bbde96699e692f1e384e8761bfd15 SHA-1: 7aba2b227fb6cdd984dbc8f4100a7d62ee4fffd1 SHA-256: a88896155f519b442123944cc255cc1096c77146418c6cdea15c43906c3759e0
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The embedded URL, disguised with a seemingly innocuous topic, likely leads to a phishing or malware distribution site. While no scripts were explicitly extracted, the PDF structure and the presence of external URIs suggest it's designed to redirect the user to a malicious resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/strik?utm_term=how+to+write+a+good+wattpad+description PDF link annotation
    • https://cdn.sqhk.co/gimexigerub/xja3yii/battle_warship_naval_empire_aircraft_guide.pdfIn PDF document text
    • https://cdn.sqhk.co/dasisogi/iaF7jgQ/best_pinball_machine_makers.pdfIn PDF document text
    • https://cdn.sqhk.co/tuwesedujila/cn2lgeb/pixel_battleground_apkpure.pdfIn PDF document text
    • https://cdn.sqhk.co/rixutixim/hbPOujj/fancy_widgets_for_ios.pdfIn PDF document text
    • https://cdn.sqhk.co/kogeledewafo/kwcfjgs/rinodaf.pdfIn PDF document text
    • http://xasedogamif.mypressonline.com/ninth_world_bestiary_2.pdfIn PDF document text
    • http://kidiwutimako.mygamesonline.org/vifatufusepafite.pdfIn PDF document text
    • https://cdn.sqhk.co/dudugetogi/gdgigiE/human_digestive_system_diagram_no_labels.pdfIn PDF document text
    • https://cdn.sqhk.co/vibebexez/jbfhage/90s_english_songs_mp3_download.pdfIn PDF document text
    • http://jejederepox.medianewsonline.com/50638683828.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368745/normal_603c040fdae37.pdfIn PDF document text
    • https://cdn.sqhk.co/baluwofuk/wjasthe/chase_canal_st_nyc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4484363/normal_605f4573122d9.pdfIn PDF document text
    • https://cdn.sqhk.co/kewixoretuze/hiemge1/anime_face_maker_go_full_apk.pdfIn PDF document text
    • https://cdn.sqhk.co/texojijoraso/1Q2h6xG/teachers_federal_credit_union_phone_number.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489979/normal_601f301908e92.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4402294/normal_6058873d33a53.pdfIn PDF document text
    • https://cdn.sqhk.co/xolovagi/heMxMhc/54892917313.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/zumezeviwakiz/duke_bike_images_hd_wallpaper.pdfIn PDF document text
    • https://s3.amazonaws.com/votubukaxogilix/signs_of_life_in_the_usa_9th_edition_publisher.pdfIn PDF document text
    • https://s3.amazonaws.com/gedexim/kezesisod.pdfIn PDF document text
    • https://s3.amazonaws.com/nokiva/gubebuxemefe.pdfIn PDF document text
    • https://s3.amazonaws.com/tejuvonixag/dumamulufusurute.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fef9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFEF9 5264 bytes
SHA-256: 232c7ef5bdd3e9ff29789e0bf6ef790a8e7b7a8a08965f62376c7fa434abfc60
font_01_sfnt_off00011102.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11102 11408 bytes
SHA-256: 5cfcc2ee5ad78edfca2ac5e38983130074200185dc404368d528634c723e41b6

Open this report in the interactive analyzer, or submit your own file for analysis.