Malicious PDF — malware analysis report

Static analysis result for SHA-256 aeedda59536e6630…

MALICIOUS

PDF

166.7 KB Created: 2022-06-01 23:37:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2022-07-15
MD5: b4e1ffe92339f47a6984813f63591650 SHA-1: 5860b5416805754e40c540f2974f87eeca95a697 SHA-256: aeedda59536e66304461d9385e47bbbb711276f88504f48213d97d692c34e47c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1204.001 Malicious Link: Malicious Link

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and ML classifier indicating maliciousness. It contains an embedded URI pointing to a suspicious domain, likely intended to deliver a malicious payload. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the presence of the URI and the ClamAV detection strongly suggest a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7428

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mifuj.co.za/XSRYdR1H?utm_term=the+mechanist+fallout+4+walkthrough+guide+pc+software+download
    • http://www.bash.cl/media/file/63097439615.pdf
    • http://aymsoft.net/aym_images/files/nowusife.pdf
    • http://old.bgk-meshkova.com/ckeditor/ckfinder/userfiles/files/68274498153.pdf
    • https://daxixulo.weebly.com/uploads/1/3/1/0/131070202/dc53976657f01.pdf
    • http://1night2day.com/UserFiles/file/53570574216.pdf
    • https://olivermilk.vn/tctt/sites/aaa/file/sozot.pdf
    • https://zopujobige.weebly.com/uploads/1/4/1/4/141426365/59a6b6b.pdf
    • http://heonlab.hu/uploads/files/pavuturovefovudoviwip.pdf
    • https://fsbulletsandbrass.com/userfiles/files/mujigituluj.pdf
    • https://kovibokasekur.weebly.com/uploads/1/3/4/8/134880184/dixesolinurew-rokafifotag-tikugoj.pdf
    • https://baduripafab.weebly.com/uploads/1/3/4/6/134623558/346033.pdf
    • http://dentish.ru/ckfinder/userfiles/files/99970924341.pdf
    • http://jyy.jp/ckfinder/userfiles/files/20220524_020945.pdf
    • https://rezezeveg.weebly.com/uploads/1/3/1/8/131871466/wewenonev.pdf
    • https://ontozescentrum.hu/tmp/kidujewivatavezizo.pdf
    • https://avenuehomes.tennisavenue.bg/files/files/85774947326.pdf
    • https://xekijemot.weebly.com/uploads/1/4/1/2/141259686/kudef-depibibuwoga.pdf
    • https://leluponiw.weebly.com/uploads/1/4/1/4/141484600/c541bf4d.pdf
    • http://ehomerealestate.org/images/file/54991914088.pdf
    • https://barufaworu.weebly.com/uploads/1/3/5/9/135957986/2539459.pdf
    • https://avphunter.ro/ckfinder/userfiles/files/fakujujiwug.pdf
    • http://cuuthuong115.com/ckeditor/kcfinder/upload/files/visobokanid.pdf
    • https://glamcamp.jp/upload/files/risekojozip.pdf
    • https://www.fsps.co.th/kcfinder/upload/files/35230681134.pdf
    • http://laparole.net/kcfinder/upload/files/16392285295.pdf
    • http://cgl.lu/userfiles/files/40450297918.pdf
    • https://bupuxikamofimap.weebly.com/uploads/1/3/4/7/134734142/3964020.pdf
    • http://rewitex.pl/userfiles/file/57467277401.pdf
    • https://doucetplasticsurgery.com/ckfinder/userfiles/files/49547488965.pdf
    • http://splhardware.com/UploadFile/file/2022040100064673499.pdf
    • https://openkomm.yussfone-crm.com/userfiles/file/61856294472.pdf
    • https://sikevitexin.weebly.com/uploads/1/3/5/3/135301450/jatedefufunozefes.pdf
    • https://tirotulesi.weebly.com/uploads/1/3/4/8/134849952/lubopikomitima.pdf
    • http://virtualcharityevents.com/vce_cake/files/files/48709912032.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00022820.bin
3cfd19359f5d0e419fb154621256993ebd4505b2acbd4848bd798dea582e0866		 pdf-font-stream PDF embedded font (sfnt) at offset 0x22820 18492 bytes
font_01_sfnt_off00025820.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x25820 16792 bytes
font_02_sfnt_off00027037.bin
c6faf7e783be769a3e20f8a96022fdc5f81a5972a1cdf6911dcb35ed14fdc706		 pdf-font-stream PDF embedded font (sfnt) at offset 0x27037 11384 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.