Malicious PDF — malware analysis report

Static analysis result for SHA-256 ab85209c2b9c6484…

MALICIOUS

PDF

79.7 KB Created: 2021-04-06 05:25:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7946632a069d97c923e5686ef35df78c SHA-1: b755fd986ad2a28b94322000a22fb04908e15a32 SHA-256: ab85209c2b9c6484fa3e528792471db03bb7724a2781eec799902dd2c259b167
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document detected as malicious by ClamAV and an ML classifier. It contains an embedded URL pointing to a potentially malicious resource, suggesting a phishing or malware distribution attempt. The document body, though heavily obfuscated, appears to be a lure related to 'carpentry for beginners pdf'. No scripts were extracted, but the PDF structure itself likely facilitates the download of a malicious payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9961

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wix?keyword=carpentry+for+beginners+pdf
    • https://cdn.sqhk.co/labifikup/iigjbWa/small_orange_balls_on_palm_trees.pdf
    • https://cdn.sqhk.co/tumosirewuw/aijgghc/53300168674.pdf
    • https://cdn.sqhk.co/vasibejovej/ciaIIih/sound_fx_harriman.pdf
    • http://deruvakibifazo.iblogger.org/voluxobobupamizevutoruwe.pdf
    • https://cdn.sqhk.co/fetesulatol/cigjhhb/vaxid.pdf
    • https://cdn.sqhk.co/tumosirewuw/ajbFhg2/netadosukeginaba.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/leributafa/samakuwepivadi.pdf
    • http://tewojaxosu.rf.gd/67596063743.pdf
    • https://uploads.strikinglycdn.com/files/746c7d17-71ea-4888-90f9-72acf72b34e7/12254155274.pdf
    • https://uploads.strikinglycdn.com/files/8b2df0d2-b255-4ced-92e4-2421d3489396/juboxavimefamafigunerofez.pdf
    • https://uploads.strikinglycdn.com/files/531c2bd6-147b-42df-b67b-d752e55018c1/what_is_9_16_plus_1_2.pdf
    • https://uploads.strikinglycdn.com/files/ea2dc610-fbad-4412-972a-1113da4e516e/kabig.pdf
    • https://uploads.strikinglycdn.com/files/936bbd0d-c488-4d08-ae5d-96d4ff441397/soxapixiz.pdf
    • https://s3.amazonaws.com/fenatagazise/95054359240.pdf
    • http://periwof.rf.gd/9359426634.pdf
    • https://s3.amazonaws.com/jizubisetebof/333680513.pdf
    • https://uploads.strikinglycdn.com/files/8b62e3df-17c9-4867-a7f6-8ece89c6ee9e/24565929147.pdf
    • https://s3.amazonaws.com/marimejerebo/how_to_ask_for_her_hand_in_marriage.pdf
    • http://zakizil.rf.gd/3rd_person_singular_worksheets.pdf
    • https://uploads.strikinglycdn.com/files/799217b0-40b4-4929-a192-4716e8711ab5/business_analytics_graduate_programs_ranking.pdf
    • https://s3.amazonaws.com/lupebesu/aws_ecs_cloudformation_template_example.pdf
    • https://s3.amazonaws.com/dupula/what_is_the_ray_tracing.pdf
    • https://uploads.strikinglycdn.com/files/49bc0c8d-2cbd-4b41-9ee8-302b7a584831/50832122253.pdf
    • https://s3.amazonaws.com/zuguvoxoki/como_saber_si_una_persona_te_miente_por_telefono.pdf
    • https://uploads.strikinglycdn.com/files/df666fd6-406b-449d-9a3c-2193b3c641f6/gatakezuxibexikawerubela.pdf
    • https://s3.amazonaws.com/paxuvagal/workplace_ppt_templates_free.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f830.bin
fca2e1f88309d9738d4b9307bf3d6e2a5ee285aca376732efa5f3bb0c204dfc0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF830 5324 bytes
font_01_sfnt_off00010a5e.bin
3086179aeb9faa3d83e37f087f3f04cb1feb05221f05af45f9f1983a86522b85		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A5E 11444 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.