Malicious PDF — malware analysis report

Static analysis result for SHA-256 b8ae2c7de90df491…

MALICIOUS

PDF

228.4 KB Created: 2021-03-20 05:20:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ff7515ccad7081e03f1599a7c63341f7 SHA-1: 97cf2c5f37dd6f367a5da2abb0a756f033011224 SHA-256: b8ae2c7de90df49170fecd398699ab91c338cd36cd49b53393bc02674c60a7a3
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, and ClamAV detection confirms its malicious nature. The ML classifier also flagged it with high confidence. While the document body is heavily obfuscated, the presence of urgency lures suggests a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9625

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wix?keyword=mind+flayer+monster+manual
    • https://cdn.sqhk.co/xisalaximel/xbMgdgi/acrylic_mirror_sheet_cost.pdf
    • https://cdn-cms.f-static.net/uploads/4426279/normal_602fef01b17c3.pdf
    • https://cdn.sqhk.co/dugelabomaw/aidygdG/buxizopamonokab.pdf
    • https://cdn.sqhk.co/vakanaju/ggjighr/funurotejapezeketumili.pdf
    • https://tuxibefogeja.weebly.com/uploads/1/3/4/3/134359070/ec87c9839.pdf
    • https://tomosuboma.weebly.com/uploads/1/3/5/3/135382902/kateviredok-nixabep-jukegigib.pdf
    • http://devicesprotectionforusers.site/wupisijifl5qal.pdf
    • https://tarimewisu.weebly.com/uploads/1/3/0/7/130739021/wekojin.pdf
    • http://kazezol.22web.org/literal_translation_examples.pdf
    • https://baraxuworasexe.weebly.com/uploads/1/3/4/6/134633060/7908744.pdf
    • http://kmplitka.shop/gixuxiwenikumixtqjf.pdf
    • http://trackengine.host/alta_complejidad_iomaamth8.pdf
    • http://rimka.xyz/8344369958f1sgw.pdf
    • https://cdn.sqhk.co/tumupowe/ezO3EOu/52996304147.pdf
    • https://cdn-cms.f-static.net/uploads/4443594/normal_604b9bf844c72.pdf
    • https://fabegobidik.weebly.com/uploads/1/3/1/4/131437275/436504.pdf
    • https://cdn-cms.f-static.net/uploads/4445104/normal_60436dee447be.pdf
    • http://bonus332.site/itunes_32_bit_versi_terbarudy3oi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://texozokuvet.epizy.com/boyle_s_law_practice_problems_with_answers.pdf
    • http://wemiwapava.epizy.com/24481246884.pdf
    • http://kelamivajaw.rf.gd/tipadun.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00032576.bin
3cb7420295dbb3c31c74bc8992e5466781ace8735453630cb8a682e1b91003bc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x32576 5040 bytes
font_01_sfnt_off0003368b.bin
d8a85b8539f08c1da2cd1211907857372d6ef448ed71b5583ffa59896fce246d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3368B 12372 bytes
font_02_sfnt_off00035efc.bin
532315dfdc59b350d447ad91845dd8cc72a836e684f536ab9a4305dc5b53fb8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x35EFC 16204 bytes
font_03_sfnt_off0003742c.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3742C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.