Malicious PDF — malware analysis report

Static analysis result for SHA-256 b366e10924c5495a…

MALICIOUS

PDF

85.6 KB Created: 2021-03-27 15:07:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 22eb5d8acb399074d0931fd20b50fc43 SHA-1: 50811bb45949238bb49bc5225300fc9f8b69bbf4 SHA-256: b366e10924c5495a59d1280c17d8b277a05955485517fd5f37511d7525f692d2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by a ClamAV detection and an ML classifier, indicating a high probability of malicious intent. The embedded URL points to a suspicious domain, likely serving as a lure for phishing or malware distribution. No scripts were extracted, but the PDF structure and embedded URI suggest a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/award?keyword=audiometria+supraliminar+pdf PDF link annotation
    • http://zivemigidefis.mypressonline.com/basic_applied_mathematics_for_physical_sciences.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://kavejanunar.epizy.com/download_instead_of_opening_in_browser_internet_explorer.pdfIn PDF document text
    • https://s3.amazonaws.com/rumezo/ashrae_heat_load_calculation_spreadsheet.pdfIn PDF document text
    • https://s3.amazonaws.com/tomaxade/medicin_de_la_calidad_ambiental.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e107d291-8ea9-4761-ada6-06210f40ad2d/61427849704.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/861f31e2-23f2-4605-84e7-398f10b88c51/how_to_reset_brother_tn450_toner_cartridge.pdfIn PDF document text
    • https://s3.amazonaws.com/zuniverijesud/luwewakumi.pdfIn PDF document text
    • http://sirulumen.rf.gd/dikabote.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b39d25ac-d100-438a-bba7-d37f62bef886/29952434078.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ba18b81b-1130-408d-9b0e-8d994dee963f/the_art_of_tidying_up_folding_shirts.pdfIn PDF document text
    • http://dozuxix.myartsonline.com/barbara_brennan_hands_of_light.pdfIn PDF document text
    • https://s3.amazonaws.com/vonuxagupeduze/bikarobusofezoriz.pdfIn PDF document text
    • http://ximogubofew.epizy.com/american_heart_association_stroke_guidelines.pdfIn PDF document text
    • https://s3.amazonaws.com/negonanopix/juxodinimikeg.pdfIn PDF document text
    • https://s3.amazonaws.com/mesotodimus/sodokarusabitafirukofofiv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ba37ed1b-fcdb-483e-92de-3eaeb9be02a8/tizojovunitapodow.pdfIn PDF document text
    • https://s3.amazonaws.com/petikamov/xofatin.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1c88f1e9-1a52-42cb-9feb-a0b7ddd6921f/kilebufizupafizesawut.pdfIn PDF document text
    • https://s3.amazonaws.com/sorapobuk/19375477273.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a0d5e737-a1a9-4397-8333-ec6a3c5cca01/graco_x7_parts.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/892b924d-3e38-4c0d-9304-ad0a1eed9024/2013_lamborghini_gallardo_spyder_performante.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/37b1a87e-730b-4a5e-928d-4b1a2deff527/gigi_jerseylicious_2018.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010ea2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10EA2 5176 bytes
SHA-256: 915853115aca865a936c4492890b1e1fbf3e7078a1238fde9649c439f0358d80
font_01_sfnt_off00012020.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12020 11944 bytes
SHA-256: b7b499ebdc0b5d679ccde25761af9cfc74789a30d7f06cb49e43d119a10b990a

Open this report in the interactive analyzer, or submit your own file for analysis.