Malicious PDF — malware analysis report

Static analysis result for SHA-256 b28c45e91163e945…

MALICIOUS

PDF

71.3 KB Created: 2021-05-02 13:10:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fdd4024c1736d7d5e612aa34d65ad839 SHA-1: 0e77edbfad8b77debd9d21f416f0ac34ed737af6 SHA-256: b28c45e91163e945b07fad26c547bb15dc1c509ba33578a90c233a1379bf14a9
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The document contains embedded URLs that lead to other PDF files, suggesting a phishing or malware distribution scheme. While no scripts were directly extracted, the presence of embedded URLs and the nature of the detection point towards a phishing attack that likely uses a malicious document to trick users into downloading further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://envomask.com/wp-content/plugins/super-forms/uploads/php/files/72ba208456e54a7471fd0314fdd6fd30/sasupipixupad.pdf
    • http://aiswaryamatrimonials.com/fck_uploads/file/12305434997.pdf
    • https://www.ppmcare.co.uk/wp-content/plugins/super-forms/uploads/php/files/uvqv5fv0b2vcbl99lls03sd7lo/nameliped.pdf
    • https://www.themeshcowork.com/wp-content/plugins/super-forms/uploads/php/files/6e47a4f700dd9f0a6ef7496436e99c4c/20494874625.pdf
    • http://alpha-th.com/userfiles/file/75019086956.pdf
    • http://lilit-realty.com/wp-content/plugins/super-forms/uploads/php/files/3blgjeac042utaqlakd9f4v5a3/zekowevuxaxebani.pdf
    • https://lakeshoresmilesdentistry.com/wp-content/plugins/super-forms/uploads/php/files/684j28i2jbknt1hbt47gv7ldn5/terapuvadoxof.pdf
    • https://signaturetowerpune.com/wp-content/plugins/super-forms/uploads/php/files/rh066te2q7vc75m11kjno2n993/20249375965.pdf
    • http://www.advokat.com/app/webroot/img/fck/file/wibikokeji.pdf
    • http://fortlauderdalelimorental.net/wp-content/plugins/formcraft/file-upload/server/content/files/1607843c2c3652---60733928167.pdf
    • https://www.auditek.fr/wp-content/plugins/formcraft/file-upload/server/content/files/1607576773716f---99437448591.pdf
    • http://www.vivelamusica.es/wp-content/plugins/formcraft/file-upload/server/content/files/160754879d6d11---dotowuj.pdf
    • https://alenakovalchuk.ru/wp-content/plugins/super-forms/uploads/php/files/f96df8bd790f67a7176cde908a24238b/77199134901.pdf
    • https://travolution.travel/wp-content/plugins/super-forms/uploads/php/files/aad7889fe5544194d1554e5b88171536/botopelevokuxegak.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://feedproxy.google.com/~r/skout/mBVl/~3/cv9VXjIrmdE/uplcv?utm_term=bendy+and+the+ink+machine+sheet+music
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cdf5.bin
affa1e4d1fa504df3317766f186bde7ae4ea1a570b9dc548cd44f585ef87532d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCDF5 5040 bytes
font_01_sfnt_off0000def1.bin
cafbbfa0e64ff3431c52487e373817fde7d44d089f46817c746ea4b406453dcc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDEF1 10272 bytes
font_02_sfnt_off00010225.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10225 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.