Malicious PDF — malware analysis report

Static analysis result for SHA-256 b6f53524084fdef2…

MALICIOUS

PDF

78.1 KB Created: 2021-03-26 11:00:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2a2693a3d4c52fda46c9d57b153f75e9 SHA-1: b823aee36feeef6364f39a450373209296f1f4ae SHA-256: b6f53524084fdef289b84441d577c7f860737ded22862588326491854bb75876
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool often used to create PDFs from web content, further supporting a lure-based attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=best+pellets+for+pumpmaster+760
    • https://cdn-cms.f-static.net/uploads/4444648/normal_6047e925aced9.pdf
    • https://cdn-cms.f-static.net/uploads/4502833/normal_6044139833b32.pdf
    • https://cdn.sqhk.co/dokamaruxif/kwjdje5/sikomijebotesogu.pdf
    • https://cdn.sqhk.co/zukasedu/bIDHifV/53341167698.pdf
    • http://jadofeduwogi.22web.org/jutinimib.pdf
    • https://cdn.sqhk.co/fiwujumejuf/jdjfldq/oxygen_sensor_cost_car.pdf
    • https://cdn.sqhk.co/gusiloxi/gc9gehj/20381154745.pdf
    • https://cdn-cms.f-static.net/uploads/4402711/normal_60318639445a6.pdf
    • https://cdn-cms.f-static.net/uploads/4477873/normal_60159ee622bef.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/5d7e00be-8abc-4acd-a919-3b4960bc9922/present_continuous_tense_exercises_intermediate_in_hindi_to_english.pdf
    • http://kokefuvikedile.rf.gd/95082957600.pdf
    • https://uploads.strikinglycdn.com/files/00321c55-d742-4809-b482-038126776079/best_book_to_learn_thermal_physics.pdf
    • https://cf336f9a-6a79-4542-9269-5b62d6eb69dd.filesusr.com/ugd/1daf83_22dd4561372a44169944a2bce1e82d4d.pdf?index=true
    • https://b24036c1-08f6-4d5b-b8c9-f4c47f26e437.filesusr.com/ugd/ae9acc_8dc3f2602197405c8a53ceabdddd73a6.pdf?index=true
    • https://6c403777-3bdb-430d-a4ca-23d5788374d5.filesusr.com/ugd/e0034b_5e2737697975471e868bd24e1967bde8.pdf?index=true
    • https://s3.amazonaws.com/kakekojezutok/reflections_translations_and_glide_reflections_worksheet_answers.pdf
    • http://rokipegokibaf.rf.gd/creative_resume_format_in_word_free.pdf
    • http://xosareregaka.epizy.com/defopuziragidoxagosis.pdf
    • https://uploads.strikinglycdn.com/files/6290c879-8d37-47f0-80ba-6339ea97506d/74342693350.pdf
    • https://s3.amazonaws.com/jumedemimo/free_bass_guitar_tabs.pdf
    • https://uploads.strikinglycdn.com/files/9333df47-e866-4a0e-b3c9-7e6a61ab770d/26423462587.pdf
    • https://s3.amazonaws.com/jazamerijekufol/dilezesanarewimejurivuvaw.pdf
    • https://s3.amazonaws.com/savifin/how_to_change_refrigerator_light_bulb_ge.pdf
    • https://uploads.strikinglycdn.com/files/99ece498-ba00-4cd1-a89d-5827e9f1b1fe/51940242827.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f2f6.bin
4a36f1851005f27c3272e39a52ee2147a135c37d8f2c02e0730908429c7cd619		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF2F6 5472 bytes
font_01_sfnt_off00010580.bin
3cf30166e0710cc106d76c380ce61f651f08774e3a0d89e904c5cccda8f4b987		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10580 11200 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.