Malicious PDF — malware analysis report

Static analysis result for SHA-256 a8d3f549790af287…

MALICIOUS

PDF

76.1 KB Created: 2021-05-16 15:52:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9eab32632bde3c512a526aead094f75f SHA-1: d0a2a29c05ebee287cc5dc5157e910dbaee7715b SHA-256: a8d3f549790af287561fb078109c16d8d519293f4b23c562d8f8958e0b3479bd
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of embedded URLs, some pointing to potentially compromised websites hosting PDF files, suggests a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a malicious document designed to redirect users to harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bonpetsupply.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606ddcbfcd620---71379450408.pdf
    • https://loskutova.site/wp-content/plugins/super-forms/uploads/php/files/e09911a6f2ea228222a363cc34c31fa1/913711414.pdf
    • http://ar-intl.net/wp-content/plugins/super-forms/uploads/php/files/vnru481788g2f5nf4nv24tcvl7/junofavoren.pdf
    • http://www.adatechotomasyon.net/wp-content/plugins/formcraft/file-upload/server/content/files/1607b540994021---26088931159.pdf
    • https://finestblogger.de/wp-content/plugins/super-forms/uploads/php/files/hj1tork23ej4hkmq913fj6v724/mojixidode.pdf
    • https://wscnaturalhealings.com/wp-content/plugins/super-forms/uploads/php/files/fea0dff66f1c67e4444b192a8a7cf991/pureviborabamimifuzejataf.pdf
    • http://www.fattyweng.com.sg/wp-content/plugins/formcraft/file-upload/server/content/files/16076c8bd62b01---rikosisi.pdf
    • http://amadpich.com/userfiles/file/57169062017.pdf
    • https://www.myjamaicais.com/wp-content/plugins/super-forms/uploads/php/files/89f5950da8f23068a7c968341b577a63/65782753558.pdf
    • https://sellerflows.com/wp-content/plugins/super-forms/uploads/php/files/a4cb9caade9dcd045059ddd69b2acb3f/womunutikapelepedisojap.pdf
    • https://rrvchefs.com/wp-content/plugins/super-forms/uploads/php/files/09dd1c3e761455ac40d88589361e5ec6/50094821580.pdf
    • http://www.reroofingbrisbaneqld.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1609f39b1c7fc4---wotivenagelajexopazuv.pdf
    • http://andrelandberg.com/userfiles/file/96036688558.pdf
    • http://www.chicagoalphas.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d50816d6e6---vodulivolakavalukonazuni.pdf
    • https://alshaabcoop.com/userfiles/file/78639819624.pdf
    • http://www.dramayaramendes.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1606f9794daf0d---9123058837.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://feedproxy.google.com/~r/skout/mBVl/~3/3CAf4wW3hvY/uplcv?utm_term=formule+chimique+du+carbonate+de+sodium
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dc18.bin
750c794a70cf68c1e684503a28ce941b6fc3784648554756621464c1a29962b8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDC18 5280 bytes
font_01_sfnt_off0000edd2.bin
80c08e08a8578dac54df5263eda50e271040fe0c2f77770a81fa74337d7248a8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEDD2 11484 bytes
font_02_sfnt_off00011344.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11344 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.