Malicious PDF — malware analysis report

Static analysis result for SHA-256 a9ac3bd3f36b8f9c…

MALICIOUS

PDF

76.0 KB Created: 2021-04-03 14:03:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: c1346e84294fb5e126267440da4e7c75 SHA-1: 5bdd7aa08c4791ee581536247a511ac2c21048f8 SHA-256: a9ac3bd3f36b8f9cd0e354b45314940c90a4eabbf0657b608768f1fc2dba9dde
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple embedded URLs, with the primary one being fokemale.ru, suggesting a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or delivering a malicious payload. The document body, though heavily obfuscated, contains metadata that aligns with the PDF's structure and potential lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/award?keyword=spastic+quadriplegia+pdf PDF link annotation
    • http://reduslim-italia.website/vulukuvabegixewulixidanm4ar.pdfIn PDF document text
    • https://cdn.sqhk.co/tadeketoxab/iajjJWM/69892350126.pdfIn PDF document text
    • http://italiahot.space/32019598260h2gxb.pdfIn PDF document text
    • http://ergors.space/polaroid_onestep_plus_manualbaedl.pdfIn PDF document text
    • http://siwupojotuj.getenjoyment.net/ti-84_plus_ce_games_download.pdfIn PDF document text
    • http://kolagozisil.mywebcommunity.org/adjetivos_posesivos_ejercicios_en_ingles.pdfIn PDF document text
    • https://cdn.sqhk.co/papazokixe/hithimn/bugufolevigubit.pdfIn PDF document text
    • http://pitushok.fun/89949085799kt0v6.pdfIn PDF document text
    • http://mibemuxagegija.mywebcommunity.org/mathematical_analysis_a_concise_introduction.pdfIn PDF document text
    • http://olipaka.xyz/doxotomogcg09j.pdfIn PDF document text
    • http://changepass.online/ukulele_strumming_patterns_4_4d4fg6.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xebuvuwov/76382958626.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e445a126-f366-488e-a270-bb9e25460f66/15764365169.pdfIn PDF document text
    • https://s3.amazonaws.com/rudelazifizuvo/sebovinod.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/abd5298e-c70f-4772-b3fb-0640fd0ebab3/pajujomenev.pdfIn PDF document text
    • https://s3.amazonaws.com/pogolo/51611362097.pdfIn PDF document text
    • https://s3.amazonaws.com/petubapizo/keto_one_meal_a_day_plan.pdfIn PDF document text
    • https://s3.amazonaws.com/tifuwuw/39998354734.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea02.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA02 5552 bytes
SHA-256: 7c47bd5721b5d369fc4c2d5a640095e5b1fa610fa086e83fb7afb64872689523
font_01_sfnt_off0000fce9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFCE9 10732 bytes
SHA-256: 9f844c43d1b93b433fd48291834f048bcb31a3bab80ac024f12b0eb57f08ad7d

Open this report in the interactive analyzer, or submit your own file for analysis.