Malicious PDF — malware analysis report

Static analysis result for SHA-256 b7dcc7d84bcc6172…

MALICIOUS

PDF

71.6 KB Created: 2021-04-02 03:51:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: b19d68561e115d88d354da1646031517 SHA-1: 565652794835b3600ad23e812c84b1c97cad1a45 SHA-256: b7dcc7d84bcc61727588b0696d21cfe8a9652babe6d262f1f4a7613d8d18fdd3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to a suspicious domain, likely intended to host a phishing page or a second-stage payload. The document body, though heavily obfuscated, suggests a lure related to "feelings and emotions pictures pdf", which is a common tactic for phishing or social engineering.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/award?keyword=feelings+and+emotions+pictures+pdf PDF link annotation
    • http://umniashka.ru/xifirit1h5i.pdfIn PDF document text
    • http://tuvosudokalidu.scienceontheweb.net/auditor_general_s_report_2020_ghana.pdfIn PDF document text
    • http://zifixoribe.scienceontheweb.net/4322005566.pdfIn PDF document text
    • https://cdn.sqhk.co/mepapogivoma/igFJgfe/23829384875.pdfIn PDF document text
    • https://cdn.sqhk.co/sajatanugeg/ohKgdha/lorezuvexedibavotu.pdfIn PDF document text
    • https://cdn.sqhk.co/letarezetap/PibLjcP/clothes_worksheets_clipart.pdfIn PDF document text
    • https://cdn.sqhk.co/rujiwujik/hhfCGhf/47966809317.pdfIn PDF document text
    • http://espaceclient-cmb.com/loopback_adapter_meaningly0a6.pdfIn PDF document text
    • https://cdn.sqhk.co/puvegipuros/6KoafWm/7958539983.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/jasadavebaga/dobajudoxot.pdfIn PDF document text
    • https://s3.amazonaws.com/patilawasu/drawing_conclusions_neuron_structure_worksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/paxuvagal/el_coronel_no_tiene_quien_le_escriba_libro_completo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b0f57802-8e1b-4b34-bfe9-52ceedbd4bb8/10188860439.pdfIn PDF document text
    • https://s3.amazonaws.com/gapivegek/tavivibemoze.pdfIn PDF document text
    • https://s3.amazonaws.com/rawesaragegugar/senior_mechanical_engineer_salary_in_canada.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/afd96487-4a28-47a5-9e1f-67d035926f6f/flat_stanley_chapter_books_in_order.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/524f1e41-a574-4e57-b5ea-1ebf2c5bb849/list_of_iatf_certified_companies_in_india.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/24688c8e-a924-466b-b21c-8c2aeeec9691/77650131427.pdfIn PDF document text
    • https://s3.amazonaws.com/vuterijoze/duninolepakuxezuj.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cfa0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCFA0 5312 bytes
SHA-256: 10b18728698c35711b85acc8fbc3b5057ace0444c04725d57329e7e2906034d8
font_01_sfnt_off0000e194.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE194 9704 bytes
SHA-256: cca852b9b2302945e8f649f318c7fba21bc91ef3f26ad30beb489c3be635c4e7
font_02_sfnt_off000102c1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x102C1 4324 bytes
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e

Open this report in the interactive analyzer, or submit your own file for analysis.