Malicious PDF — malware analysis report

Static analysis result for SHA-256 b62dd7d17d3fe19b…

MALICIOUS

PDF

74.4 KB Created: 2021-03-14 16:50:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d84732a6d8824d779f8ec4dc3c9b72b7 SHA-1: 3649c8edce5f7e8f5c6e0fe7a743259a568f6a35 SHA-256: b62dd7d17d3fe19b7c113acc62354f8e8b3ff1be39cc8d890e510813231f4962
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL, identified as malicious by heuristics and ClamAV. The PDF structure and embedded content suggest it is designed to trick users into visiting a malicious website, likely for phishing or malware distribution. No scripts were extracted, but the presence of an external URI points to a common attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=%25D1%2581%25D0%25B5%25D0%25B2%25D0%25B5%25D1%2580%25D1%2583%25D1%2581+%25D1%2581%25D0%25BD%25D0%25B5%25D0%25B9%25D0%25BF+%25D0%25B8+%25D0%25BC%25D0%25B0%25D1%2580%25D0%25BE%25D0%25B4%25D0%25B5%25D1%2580%25D1%258B
    • https://cdn-cms.f-static.net/uploads/4491669/normal_5fd793333a4b9.pdf
    • https://static.s123-cdn-static.com/uploads/4384649/normal_5fe1bd6e09fab.pdf
    • http://aycotoro6.xyz/pixel_art_software_for_games41ncf.pdf
    • http://winoorama.site/39040444370cq7bh.pdf
    • http://getliterate.online/votopepajuwenujisesok6v32t.pdf
    • http://najisemure.medianewsonline.com/apc_smart_ups_2200_battery_charge_lights_flashing.pdf
    • http://azalea.store/magulafopaja48sry.pdf
    • https://cdn-cms.f-static.net/uploads/4365653/normal_602b9bbe551fa.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/jevelel/73763950960.pdf
    • https://98be45bc-63b9-4117-aff7-84a3d4f2c4a0.filesusr.com/ugd/90c678_6c63191b50084307bf30207239615871.pdf?index=true
    • https://s3.amazonaws.com/zedilegol/86103606537.pdf
    • https://4adff18d-dc39-4349-be2c-eeb12737f1cb.filesusr.com/ugd/9117e0_7442a72e9b1a4c94a1893c4f0c674f9c.pdf?index=true
    • https://9170d309-caca-4186-8987-bf6b40ce219c.filesusr.com/ugd/baef12_59db1614e0a7409fa0e194cfa6f278bb.pdf?index=true
    • https://89e5ed4a-33eb-42a6-b5f1-9fc07ea1e15b.filesusr.com/ugd/ff68bb_a7e7e29a75c240d3af785afb6b4d9172.pdf?index=true
    • http://solarujarinobo.myartsonline.com/how_to_use_the_singer_handheld_sewing_machine.pdf
    • https://s3.amazonaws.com/tubupejevomo/banner_template_minecraft_psd.pdf
    • http://pabewuvuxaf.onlinewebshop.net/monsta_island_czars_rodan.pdf
    • https://s3.amazonaws.com/jotogorurekuro/tepenudanoma.pdf
    • http://nuzikenevizut.onlinewebshop.net/zevajoralowuto.pdf
    • https://5fdaa9e0-ad6d-443b-8779-beb8e45026dc.filesusr.com/ugd/05301a_2324f06aea2141ae9ae24cfe39864d9a.pdf?index=true
    • http://pulutugorivexek.atwebpages.com/88951196191.pdf
    • https://s3.amazonaws.com/guxosa/73724654267.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d754.bin
790fbaee8f88a6cb4fcda7538b52c8d81834a5786acf4840e1ea5dab7d9ce073		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD754 5692 bytes
font_01_sfnt_off0000e9c6.bin
94e1d3df5fffff6659b0f4ab4e7e60b2357d672a35c2e303adda61796b608d0e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9C6 15688 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.