Malicious PDF — malware analysis report

Static analysis result for SHA-256 b56409a672b08fb0…

MALICIOUS

PDF

71.2 KB Created: 2021-02-10 16:33:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: e0f3616866cdbd98ebde24cc1a0eeb11 SHA-1: b0bc368c84ffb90df0d38f88668e31d9d6279868 SHA-256: b56409a672b08fb0ba02629573c6999fdfc686e8268bb57023cb969958ee683f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a suspicious domain, identified as malicious by ClamAV and ML classifiers. The document body, though heavily obfuscated, suggests a lure related to a 'fishing report', likely intended to trick the user into visiting the malicious URL. The presence of external URIs and the overall detection by multiple security tools strongly indicate a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/aws?utm_term=kittles+outdoors+fishing+report PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4371498/normal_5fc6cd1178a90.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4419003/normal_600c8ce29fc01.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380881/normal_5fdc1751732e4.pdfIn PDF document text
    • http://garant-ritual.online/sketchup_install_plugin_manuallylbmdz.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4478393/normal_60010c202565e.pdfIn PDF document text
    • http://romeita.space/nisaresomefusogefarih14q0.pdfIn PDF document text
    • http://instup.xyz/707544579743gi6t.pdfIn PDF document text
    • http://xplaintome.ru/29554774307d436u.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4426832/normal_5ffefb2c4d896.pdfIn PDF document text
    • https://zafozudakajadev.weebly.com/uploads/1/3/0/8/130814863/gilote.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4381748/normal_5ff797c7d8c8f.pdfIn PDF document text
    • https://zadobixif.weebly.com/uploads/1/3/1/4/131437920/6136c32936ef.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370764/normal_60235677ce60d.pdfIn PDF document text
    • https://linepofikoleku.weebly.com/uploads/1/3/4/4/134492010/7456258.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388067/normal_600e57dcf0fc9.pdfIn PDF document text
    • http://form-copyrightservices.com/xufenibidivezevugikizitxfqj.pdfIn PDF document text
    • https://zokesafan.weebly.com/uploads/1/3/0/7/130775675/3234767.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4479673/normal_60231b6c42f0d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4371783/normal_5ffeb852d68f4.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/sixenogafopoj/free_writing_prompt_worksheets_for_3rd_grade.pdfIn PDF document text
    • https://s3.amazonaws.com/xifabilejilab/baaghi_movie_in_tamil_dubbed.pdfIn PDF document text
    • https://s3.amazonaws.com/genukopapovixo/chale_aana_song_whatsapp_status.pdfIn PDF document text
    • https://s3.amazonaws.com/takurugilij/casual_survival_games_android.pdfIn PDF document text
    • https://s3.amazonaws.com/jiwisi/vexurilowub.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d7fa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD7FA 5064 bytes
SHA-256: 4f9d6d2d5fcb06a6c11c8c452e6c06d7e6ebe4f5e357f689cb7af0c3d415edaf
font_01_sfnt_off0000e935.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE935 11376 bytes
SHA-256: 10548ccfad8e22ebb8748b7c1c04b95fa951795f99d72461b2a5b541b698f03c

Open this report in the interactive analyzer, or submit your own file for analysis.