Malicious PDF — malware analysis report

Static analysis result for SHA-256 b2fb47f94f940c26…

MALICIOUS

PDF

104.1 KB Created: 2021-04-02 00:01:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9ee831f172976ed5d502dec8fdccba55 SHA-1: dd968c86a7a96f16ca12cfb32acf07899508cb7d SHA-256: b2fb47f94f940c26427d74d2b3d7b69cf75c90e47c5d70ae25cc16643bfdd19d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of embedded URLs, specifically 'https://leonvi.ru/award?keyword=sindrome+cardio+hepatico+pdf', suggests a phishing or redirection attempt. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are commonly used to deliver malicious content or redirect users to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/award?keyword=sindrome+cardio+hepatico+pdf
    • https://cdn.sqhk.co/menodotitit/i4NUhgc/bumalafatupulukefaj.pdf
    • http://lulopoboxefon.scienceontheweb.net/introduction_to_management_accounting_16th_edition_solutions_chapter_3.pdf
    • https://static.s123-cdn-static.com/uploads/4392209/normal_60061c150846f.pdf
    • https://cdn-cms.f-static.net/uploads/4366337/normal_6024f371795bc.pdf
    • https://cdn.sqhk.co/fedugaxoloz/c5hahbI/youth_baseball_league_names.pdf
    • http://rent-nout.site/xusibega1je50.pdf
    • http://changepass.online/ukulele_strumming_patterns_4_4d4fg6.pdf
    • http://gayerkan.com/phases_of_the_moon_sheet_ks231p0i.pdf
    • http://xasanefajisa.sportsontheweb.net/personal_attributes_of_a_teacher.pdf
    • https://cdn.sqhk.co/nesuxozajek/igQDhaK/56045806205.pdf
    • https://cdn-cms.f-static.net/uploads/4471958/normal_6017cf2f872fa.pdf
    • http://mnatural.space/washtenaw_community_college_academic_calendartt8nd.pdf
    • http://1yamal.space/denemuxutolekojidaseken71ert.pdf
    • https://cdn.sqhk.co/sategexarom/0nhiGqn/lil_yachty_freestyle_go_crazy.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/24235be4-183b-49c4-870a-31e5166d0aaa/molecular_biology_jobs_atlanta.pdf
    • https://uploads.strikinglycdn.com/files/143c4d6e-53e2-403a-b60d-e3d98b38e93e/13037977668.pdf
    • https://uploads.strikinglycdn.com/files/212a8bc7-a0bc-4353-ad56-7af4f28415ae/how_do_i_reset_my_linksys_range_extender.pdf
    • https://uploads.strikinglycdn.com/files/f46cbb3d-239d-4b79-afba-3cc98d1f61cd/mowodowow.pdf
    • https://uploads.strikinglycdn.com/files/e6e0274d-e23c-49ee-a8a5-5cdda6838e21/30446068108.pdf
    • https://uploads.strikinglycdn.com/files/a8a9450d-8958-4d3c-94aa-3183d82d1de8/is_it_normal_to_not_see_a_heartbeat_at_6_weeks.pdf
    • https://uploads.strikinglycdn.com/files/9b83f06f-4fa4-41e0-aaa2-1a9b97ed0587/electrical_engineering_objective_book_free_download.pdf
    • http://vamavaremimot.atwebpages.com/biomass_briquetting_technology_and_practices.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00015445.bin
79238919a133003461e66d4d3e5737433f31e32c0b626132f7b2b9dfcc866ea9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15445 5288 bytes
font_01_sfnt_off00016619.bin
24be0651936ce14b211dc3dea140a76b2342d2fa30279303d45c3d77a240673f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16619 14588 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.