Malicious PDF — malware analysis report

Static analysis result for SHA-256 b825dd6c4bb510e8…

MALICIOUS

PDF

29.6 KB Created: 2018-07-23 01:37:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: 46357b5003a92c0056fd7db268032e5d SHA-1: 852f752780cb1b56829770fc46858d743f17a648 SHA-256: b825dd6c4bb510e8dc0f55576ae8eb651e28a59ae731b11c8a57d61a2f302e68
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1204.002 Malicious Link

This PDF document exhibits evasion techniques, specifically combining an external action with a parser-evasion structure. It contains a URL shortener pointing to http://ow.ly/WQfp30l480y, which likely leads to a malicious site. The document's structure and the use of a URL shortener suggest an attempt to lure the user to a harmful destination, characteristic of phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier clean score 0.0028

Heuristics 3

  • Clickable PDF combines external action with parser-evasion structure high PDF_ACTION_PARSER_EVASION
    PDF has an external clickable URI together with object graph or xref structures that make parsers disagree, such as divergent duplicate objects, parser divergence, or xref offset mismatch. That combination is stronger than a plain link: the document is both an outward-action carrier and a parser-confusion/evasion sample.
  • Clickable URI uses URL shortener medium PDF_URL_SHORTENER_URI
    PDF contains a clickable HTTP(S) action whose destination is a URL shortener. This hides the final landing page from static review and is common in phishing redirect PDFs.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotype.comMonotype In PDF document text
    • http://ow.ly/WQfp30l480yIn PDF document text
    • http://www.monotype.com/html/mtname/ms_timesnewroman.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000016cb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16CB 16436 bytes
SHA-256: 540b3f1013629b6dcd66fe30221c5e825e3caefafc5e9f112e97e4434cc7e654
font_01_sfnt_off00003f93.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3F93 8752 bytes
SHA-256: ab6da4b55c8ae2a85eb8116354a4ce434696faad02e3121ff3c0aee377878202
font_02_sfnt_off00005596.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5596 12452 bytes
SHA-256: 6664b199910864d54774f057edc35326b6e4294cf0fa1c54ecd6621bddb3c5f1

Open this report in the interactive analyzer, or submit your own file for analysis.