Malicious PDF — malware analysis report

Static analysis result for SHA-256 ade735caaf8b5a8f…

MALICIOUS

PDF

77.2 KB Created: 2021-04-16 17:40:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4eecf9057b848086792a0b12667cbf49 SHA-1: 13bbf289a80ccd3f45eee102d22b6223c03f56d9 SHA-256: ade735caaf8b5a8f47db01052a39b1088da5ea3f6930a652c243c4ced957679a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL that appears to be part of a phishing or scam attempt, masquerading as search results for a specific product. No scripts were extracted, but the presence of the malicious URL and the overall classification strongly suggest a phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=devilbiss+air+compressor+pump
    • https://static.s123-cdn-static.com/uploads/4486550/normal_5ffcd3cdea619.pdf
    • https://cdn.sqhk.co/fimegasaz/gifiihi/53163400780.pdf
    • http://verapubudal.22web.org/apocalypse_meltdown_espaol.pdf
    • https://cdn.sqhk.co/ritapabinap/hcghglf/toilet_starts_running_randomly.pdf
    • https://cdn-cms.f-static.net/uploads/4450424/normal_602de723b93fe.pdf
    • http://fuluwube.22web.org/allahabad_university_admission_form_2019_ba.pdf
    • https://static.s123-cdn-static.com/uploads/4413462/normal_5ff2730602ffc.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/ea9a9d8a-8dce-4036-96ec-cc00e792446e/wozolonejibiroxewidibeko.pdf
    • https://uploads.strikinglycdn.com/files/143c2f31-c7e3-4fe2-9ee3-b03afa932b19/desagafedavovewalugiwib.pdf
    • https://uploads.strikinglycdn.com/files/2f342693-f3dd-4e5e-b935-2bd9b712f750/57353611098.pdf
    • https://uploads.strikinglycdn.com/files/553ff67f-b1d6-4dc7-ae79-e6d1e8d520b3/why_is_water_coming_out_of_my_garbage_disposal.pdf
    • https://uploads.strikinglycdn.com/files/8e366ef7-7c3b-44df-87c1-7234ee0c76a8/xedumevitotip.pdf
    • https://uploads.strikinglycdn.com/files/5bbdd608-1bf3-41ba-ad9c-895a85dcafb8/skyui_error_code_1_2020.pdf
    • https://uploads.strikinglycdn.com/files/55a7bfbe-e8ce-4170-856b-5178b9251b6b/drawing_for_kids.pdf_free_download.pdf
    • https://uploads.strikinglycdn.com/files/51766d4a-e708-43ea-a781-cbf58f073b79/how_to_activate_metabank_visa_gift_card.pdf
    • http://jebefufodapiwi.epizy.com/40980581837.pdf
    • https://uploads.strikinglycdn.com/files/2a7e284a-0bb1-4f25-b9d1-407a58d552cc/genie_pro_88_1_3_horsepower_screw_drive_remote.pdf
    • http://kakapefetabol.rf.gd/lamumaxegiwaxob.pdf
    • https://uploads.strikinglycdn.com/files/44bba311-d961-4527-af76-fe287df9b44a/murray_lawn_mower_carburetor_linkage_diagram.pdf
    • https://uploads.strikinglycdn.com/files/9049167f-3dfd-4d90-878c-fe135dffce35/87672766211.pdf
    • https://uploads.strikinglycdn.com/files/6e593f61-34b1-46bd-b94f-95c941185788/jofajixuxuwotubo.pdf
    • https://uploads.strikinglycdn.com/files/4a3e7d9b-70cc-4705-81d1-2541b03df7d3/pazadodolan.pdf
    • https://uploads.strikinglycdn.com/files/5067341c-3966-4331-a216-f04c65051814/like_water_for_chocolate_book_free.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000effb.bin
d6d2522f5631d5b0191f03920805f1f818067ae9456908d9fa14209286de2902		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFFB 5276 bytes
font_01_sfnt_off000101dc.bin
1d8686dfcb9faf5f4d267278e5ced9ab110ea49e6e1db4fec40ba3d36b823fce		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101DC 11132 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.