Malicious PDF — malware analysis report

Static analysis result for SHA-256 aec76012a4193585…

MALICIOUS

PDF

78.1 KB Created: 2021-04-05 00:00:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fa635ae66bba7edcb3a628f29ef23b61 SHA-1: 7d7df4347054ad1cf9716cf86a5392a7ea514017 SHA-256: aec76012a419358562b446c86cf85de5c43715e38db908c7a71341939e3de082
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL that leads to a suspicious domain, likely serving as a lure for phishing or malware distribution. The document body, though heavily obfuscated, contains fragments that suggest a profile-related context, aligning with a phishing pretext.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/aws?utm_term=1794-+aent+add+on+profile
    • https://cdn.sqhk.co/rurufimibiwe/njdXKKL/rugby_league_premiers_1995.pdf
    • https://cdn.sqhk.co/xoberuweri/iiibidj/crossfire_zp_generator.pdf
    • http://napufokotipo.getenjoyment.net/ms_sql_dba_interview_questions.pdf
    • https://static.s123-cdn-static.com/uploads/4422373/normal_5ff8955e8899d.pdf
    • https://static.s123-cdn-static.com/uploads/4382643/normal_5fed1313bd3c0.pdf
    • https://cdn.sqhk.co/wenegifuteg/1UaZgdA/23015037668.pdf
    • https://cdn-cms.f-static.net/uploads/4479678/normal_6043f7d07f729.pdf
    • http://tozaworewinox.mywebcommunity.org/zetubozelusumafujexedi.pdf
    • http://xizugef.medianewsonline.com/20224498920.pdf
    • https://cdn.sqhk.co/zowonefaso/igfjf2B/black_wicker_christmas_tree_skirt.pdf
    • http://lulodexov.scienceontheweb.net/23206993665.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://c07b3cb0-7d4a-4e65-9c62-eb3bd0ce3b6b.filesusr.com/ugd/7560d5_a94a9ab72cdc493192d499667b439929.pdf?index=true
    • https://s3.amazonaws.com/fodose/one_ui_version_android_pie.pdf
    • https://3568c1c9-c281-4b9a-9ea9-d5d291e0176b.filesusr.com/ugd/e5d8db_35a26a755c8940b28c6143e8097cfe2d.pdf?index=true
    • https://s3.amazonaws.com/gezizefefififa/nusik.pdf
    • https://s3.amazonaws.com/rizijubovapuk/product_brochure_design_templates.pdf
    • https://1fa67a36-2e8b-44cc-a955-751d80433762.filesusr.com/ugd/d85e51_7fd20ec176b649a7931df06adc311cc5.pdf?index=true
    • https://ba428ff1-d53d-4eb5-bdb2-cc960067f420.filesusr.com/ugd/7041e4_1134281a77174d308173e04082eaaebb.pdf?index=true
    • http://jirabasojexosud.atwebpages.com/72375026327.pdf
    • https://s3.amazonaws.com/wefemabeni/52643080112.pdf
    • https://s3.amazonaws.com/kosamupim/facebook_video_er_mozilla_firefox.pdf
    • http://wopojofa.atwebpages.com/amfori_bsci_code_of_conduct.pdf
    • http://bebovufuvuji.myartsonline.com/dell_ultrasharp_u2415_review_photo_editing.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f457.bin
6bf876ca0c707f31bd26d0d7c32d9b62c662fa4c7589482c569976649bff8f09		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF457 5172 bytes
font_01_sfnt_off00010617.bin
36f9f7bd4c4ab27d79a20b3dc5f9a1ffc96a909a4fd646c88f5a195091792e3a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10617 10908 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.