Malicious PDF — malware analysis report

Static analysis result for SHA-256 b06e452a8b582537…

MALICIOUS

PDF

79.8 KB Created: 2021-03-31 23:22:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7d38b42e869718a46aac5c000867f63c SHA-1: 1dea50b98c54589a947d6f36e61c1f4c14b1f372 SHA-256: b06e452a8b582537190c52455b84d2ee63254c88b9500d5510ee0206e0ffe3ae
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URLs suggest a phishing or content-luring scheme, aiming to direct users to download further malicious content. While no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a phishing attack, likely using a spearphishing attachment vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=how+linux+works+free+pdf
    • http://tareworig.mywebcommunity.org/kuduxogovov.pdf
    • http://piwopamedu.iblogger.org/ielts_speaking_questions_part_3.pdf
    • https://sekazijefof.weebly.com/uploads/1/3/2/3/132303314/1652693.pdf
    • http://naturazuwedemoz.22web.org/savukanijesadada.pdf
    • https://cdn.sqhk.co/dapumexader/OqhcLij/75383530235.pdf
    • https://cdn.sqhk.co/zopimoforaja/jhPgiDU/skip_bo_rules.pdf
    • https://cdn.sqhk.co/laxiroroweno/gghdY27/56035451400.pdf
    • https://tamilavijunaw.weebly.com/uploads/1/3/4/5/134506647/dc698bb.pdf
    • http://gagimubu.mywebcommunity.org/how_many_books_in_the_shade_of_vampire_series.pdf
    • https://cdn.sqhk.co/dovawowo/UDlhgFo/child_day_care_services_near_me.pdf
    • http://letabumo.getenjoyment.net/arousal_in_sport.pdf
    • https://pobivizitonep.weebly.com/uploads/1/3/2/8/132815986/9625661.pdf
    • https://cdn.sqhk.co/kavuluxaja/fgKCfii/6328615347.pdf
    • http://vafefenovabire.22web.org/kipopizogaberux.pdf
    • https://wekakukuzibeli.weebly.com/uploads/1/3/4/0/134000436/3171460.pdf
    • https://jufoximivovanad.weebly.com/uploads/1/3/4/0/134013024/bufomar.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://topuwagib.epizy.com/jotojusoxepuvalaxagatiri.pdf
    • https://uploads.strikinglycdn.com/files/ccd19ab5-824f-40db-9c32-02a9d4718f6b/invisible_define_in_a_sentences.pdf
    • http://fiteromuroxunu.epizy.com/phonetic_alphabet_police_officer.pdf
    • https://uploads.strikinglycdn.com/files/543bff71-f59c-4273-bbd8-10be4be1eb15/98472160002.pdf
    • https://uploads.strikinglycdn.com/files/2f8d758b-54cc-4d7e-9e9d-858afbcc5ca1/the_verification_of_property_condition_form_is_filled_out.pdf
    • http://xatowumo.epizy.com/kojapapome.pdf
    • http://wadoromutisagar.myartsonline.com/fundamentals_of_engineering_economics_4th_edition_free.pdf
    • https://uploads.strikinglycdn.com/files/bfe521c7-d655-4c90-9992-250a61966dcc/the_wine_bible_latest_edition.pdf
    • http://bajupigirosinaf.atwebpages.com/cambios_sociales_en_la_vejez.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f996.bin
3a290b380ecaaed3013b4f740ae8c55b96ba4b5e8441d6136966565f26c546ca		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF996 5008 bytes
font_01_sfnt_off00010ac4.bin
c47e195c7ef7d1da33e82d969dfa8d19f9201b342b4adf2f0e6fd4ad2f5eb910		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10AC4 11444 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.