Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad22bf1f76050c0d…

MALICIOUS

PDF

72.2 KB Created: 2021-03-23 00:57:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 92882ec79388ac24eb37d2abcb95ec78 SHA-1: 41a9d812a24f82b6098c292e7637e61f4e01f867 SHA-256: ad22bf1f76050c0d058ec3f77f76ebc82b98a14dc226a284b8f46cdba8ed7d92
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The PDF contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware download site. Although no scripts were explicitly extracted, the PDF structure and embedded URLs suggest it's designed to exploit users through deceptive content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/aws?utm_term=pioneer+deh-80prs+car+stereo+review
    • https://fedusinejedutim.weebly.com/uploads/1/3/4/0/134040989/5288986.pdf
    • http://lifelalulenomip.mygamesonline.org/lajog.pdf
    • http://bemijaragilez.22web.org/fhlmc_underwriting_guidelines.pdf
    • http://zanartcc.net/culture_and_imperialism_introduction_summaryjdp3e.pdf
    • https://xatuguje.weebly.com/uploads/1/3/1/8/131856293/5992558.pdf
    • http://jasetukuxazep.22web.org/google_play_store_not_opening_android.pdf
    • http://momentshop.space/analytic_geometry_and_calculus_3pvjn4.pdf
    • https://xaniwunedevivat.weebly.com/uploads/1/3/4/4/134470123/cebb1a887900e.pdf
    • http://manovina.mypressonline.com/sofabarafo.pdf
    • http://fisareboveda.getenjoyment.net/latulaw.pdf
    • http://hookup157.fun/sofapopepabizakusuwufuswq529.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://xufoziminep.onlinewebshop.net/scholastic_2nd_grade_workbook_printable.pdf
    • http://pavabiza.atwebpages.com/3141405196.pdf
    • https://s3.amazonaws.com/tapelu/values_list_activity.pdf
    • https://ca6b24e6-01cd-4368-a310-1df05077a315.filesusr.com/ugd/11b39a_f2e7ba518fef4814ab0a3986135e5442.pdf?index=true
    • http://jizipok.rf.gd/pathogenesis_of_salmonella_typhi.pdf
    • https://a4758657-6aaa-4003-b0f6-1957e800abfd.filesusr.com/ugd/70c1f8_a981754abe144684893ea406134a8835.pdf?index=true
    • https://s3.amazonaws.com/sajatofubote/accel_world_light_novel_volume_23_summary.pdf
    • https://s3.amazonaws.com/dogazisuze/esma_guidelines_mifir_transaction_reporting.pdf
    • https://s3.amazonaws.com/tabobujimo/ch_play_android_6._0._1.pdf
    • http://xovanesoku.epizy.com/33529359314.pdf
    • https://s3.amazonaws.com/kudufigunabi/math_154b_completing_the_square_worksheet_answer_key.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d8ab.bin
6c151d7b71e7dbe514b3c98deb1c1ea5ba733dc9e9a9605beccd1a38041f6579		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD8AB 5652 bytes
font_01_sfnt_off0000ebf6.bin
b75d0e859698fb99fc78316a162d3b2397f87f7271d6c0009eefac7dc5b2d7c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEBF6 11160 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.