Malicious PDF — malware analysis report

Static analysis result for SHA-256 af70ba40a5bfb695…

MALICIOUS

PDF

211.1 KB Created: 2021-03-30 09:01:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: d2e57cf0c7f93d76849abedd7eb8c6ae SHA-1: addb50a0995bd3c568ab7d96993e3f271f5c86e3 SHA-256: af70ba40a5bfb69598761dd6aae8c8ded2b9ec6a273b29a7a9a69be15c77c848
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains embedded URLs, one of which is presented as a definition for "urbanisasi pdf". The ML classifier and ClamAV detection strongly indicate maliciousness. The presence of embedded URLs suggests the document is designed to redirect users to malicious sites, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9538

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/award?keyword=definisi+urbanisasi+pdf PDF link annotation
    • https://ramaxudefe.weebly.com/uploads/1/3/4/0/134042793/8696168.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454803/normal_5fdc16488912d.pdfIn PDF document text
    • https://damanula.weebly.com/uploads/1/3/1/8/131856109/ganor.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4413575/normal_5fe12131b21bf.pdfIn PDF document text
    • http://lufatomitonad.22web.org/9126352647.pdfIn PDF document text
    • https://gabofulonu.weebly.com/uploads/1/3/4/7/134730366/93f9c.pdfIn PDF document text
    • https://lepifopinitomo.weebly.com/uploads/1/3/2/6/132696280/tajug.pdfIn PDF document text
    • http://bukobaxaz.getenjoyment.net/alemania_en_la_segunda_guerra_mundial.pdfIn PDF document text
    • https://cdn.sqhk.co/tixuniwe/hcjgBf0/zonakofowelepakub.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4409606/normal_600752ff5773f.pdfIn PDF document text
    • http://bozidik.22web.org/tony_little_gazelle_freestyle_pro.pdfIn PDF document text
    • https://geserani.weebly.com/uploads/1/3/4/3/134347405/rewumolelezijujipita.pdfIn PDF document text
    • https://valuzobuxile.weebly.com/uploads/1/3/2/7/132711949/e0619d48b6d76.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4452385/normal_6056e7f31b37c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4428341/normal_5ff81c5171287.pdfIn PDF document text
    • https://vebudizegegogog.weebly.com/uploads/1/3/1/3/131398423/8feb6.pdfIn PDF document text
    • https://cdn.sqhk.co/mokabawimav/KVkijjh/techcrunch_disrupt_2019_berlin.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://geforagegi.atwebpages.com/17589840782.pdfIn PDF document text
    • http://jeborawaleko.atwebpages.com/anatomy_of_farm_animals.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_008_off000332fb.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x332FB 17008 bytes
SHA-256: 223e2f8bde5acbb0957da1e56cb494b89dc63c645fd85f11ab6e098129c38e41
font_00_sfnt_off0002e6d0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2E6D0 5140 bytes
SHA-256: 687482ea94b025a1338c26a66a29c5a9c83f9ef1f0cf3d6de41f869e9ba3fd8b
font_01_sfnt_off0002f85d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2F85D 21460 bytes
SHA-256: f1e2182e5387290ac1ccd02622f2bb87a798c43cea1104a1d0f3941461623d78

Open this report in the interactive analyzer, or submit your own file for analysis.