Malicious PDF — malware analysis report

Static analysis result for SHA-256 b6fd08e4e4866415…

MALICIOUS

PDF

83.8 KB Created: 2021-03-16 06:56:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e43d2ee080c8d9469c92e6398c13dced SHA-1: b5a274a4c0c855e84d7ba506bcb4fdf1cb07beeb SHA-256: b6fd08e4e4866415539d9a6b9816339ae066b801d449c599171b1f2c833dff87
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing site. The document body, though heavily obfuscated, appears to be a lure related to celebrity net worth, consistent with phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/strik?utm_term=how+much+is+bruce+lee%2527s+daughter+worth
    • http://dupuladusudired.mypressonline.com/resistor_color_code_app_ios.pdf
    • http://sujabupinoda.scienceontheweb.net/how_to_install_games_on_ti-84_plus_mac.pdf
    • http://jedomagisuw.getenjoyment.net/a_moveable_feast_hemingway_download.pdf
    • https://cdn.sqhk.co/mawejoxejobe/1ggLghz/55681989897.pdf
    • https://cdn.sqhk.co/lorotukogof/ijgjXgh/mexawutawevajogem.pdf
    • https://cdn.sqhk.co/bisulalu/ihgfBih/zeds_dead_white_satin_download.pdf
    • http://rosativiwam.mypressonline.com/bubudelutugeki.pdf
    • https://cdn.sqhk.co/ruvojeve/hdshjhd/american_conference_men_s_basketball_tournament_2020.pdf
    • http://nenegifivujaxu.mypressonline.com/41210331452.pdf
    • http://rowowesofazov.medianewsonline.com/16701746659.pdf
    • https://cdn.sqhk.co/someteku/gcjeqja/kukemadabenirol.pdf
    • http://rumigiwataj.getenjoyment.net/68415471812.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://fd0ef26f-7b8f-4c91-b3b2-19f7ec93487a.filesusr.com/ugd/4174bf_1ea4b39d1c844b29a0446244c0d347bc.pdf?index=true
    • https://69cf8a46-0d3d-4b71-8fd1-93df925da18e.filesusr.com/ugd/e4064d_3259722bf7db4f1fa1b0d4e00cbe0f95.pdf?index=true
    • http://wipibefab.onlinewebshop.net/small_and_decentralized_wastewater_management_systems_crites.pdf
    • https://uploads.strikinglycdn.com/files/35ef3a7d-844d-4346-a74c-d068110e9f61/dryer_not_drying_clothes_samsung.pdf
    • https://ac3db616-04cb-40f1-8357-c67041f5e20c.filesusr.com/ugd/eda9ba_7685173695a5453da4d06a0ba42a6696.pdf?index=true
    • https://uploads.strikinglycdn.com/files/0142ea96-801b-4977-b7f5-78bde20ab732/harry_potter_half_blood_prince_movie_recap.pdf
    • https://c2093f15-f4fb-4bda-9582-db5404103fa6.filesusr.com/ugd/b28561_13172bb89d50407eb876d9c1f335b7ac.pdf?index=true
    • https://ca30e0e0-ecf2-44ab-b6a2-fe26291458be.filesusr.com/ugd/34e21e_56751e71dbaf4dee9dc611984382d536.pdf?index=true
    • http://kanulinuwuri.epizy.com/telamajusol.pdf
    • http://gujimosodaza.myartsonline.com/wenafujiresizupabatuditop.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc1f.bin
9186ea5e0440fddd05fb7427fe0b217eeaa0e4805634162859c6c9beb19b19b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC1F 5356 bytes
font_01_sfnt_off00010e66.bin
c81fc5fa07271a5242ca954982921467b68329559536bded5f8a7fb0a0c14c6b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E66 10952 bytes
font_02_sfnt_off000133a0.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x133A0 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.