Malicious PDF — malware analysis report

Static analysis result for SHA-256 b9c4392bc93b2dd8…

MALICIOUS

PDF

81.6 KB Created: 2021-05-08 05:14:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-23
MD5: 1872ab39bc46b92444e6ac32f79976d8 SHA-1: bc3bdf1da997e953cc77fedbbfb9e41450a0dc5b SHA-256: b9c4392bc93b2dd8fe36693057837b3e823dec8d24f19dbc0f18e9651c66f6e4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL that mimics a search result, likely intended to trick the user into navigating to a malicious site. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool sometimes used to create malicious PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/strik?utm_term=what+is+21+day+meal+plan PDF link annotation
    • https://cdn.sqhk.co/devisojop/jbifjjb/music_volume_equalizer_pro.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4485578/normal_5fd07b28ccf5a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4427293/normal_6052fde2f1596.pdfIn PDF document text
    • https://cdn.sqhk.co/fikalibumi/OFiiUfv/wejovar.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489061/normal_5fd9034eda780.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4455381/normal_6045148c33c48.pdfIn PDF document text
    • https://cdn.sqhk.co/woluzadeviv/sNSJiad/milejizitigoxaz.pdfIn PDF document text
    • https://cdn.sqhk.co/goluxewimabu/7sEMjir/gardenscapes_219_help.pdfIn PDF document text
    • http://instahelpforbusiness.com/welejepidifumufoxuzoleka9ea05.pdfIn PDF document text
    • https://cdn.sqhk.co/sixerusesebu/0USkjbL/doom_patrol_trailer_ita.pdfIn PDF document text
    • https://cdn.sqhk.co/vifejoneses/xgticb7/viruses_are_living_things_true_or_false.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388814/normal_5fdc7e1a8732c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4382629/normal_5fe51a4972461.pdfIn PDF document text
    • https://cdn.sqhk.co/zevolazezag/0jjjjeE/movistar_top_up_and_calls.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450721/normal_604161c2d6292.pdfIn PDF document text
    • https://cdn.sqhk.co/jusupovexewa/KOJ5Oja/furious_car_driving_2020.pdfIn PDF document text
    • http://mastericy-chistoty.ru/saxajokewijofae2uaa.pdfIn PDF document text
    • https://cdn.sqhk.co/veletafi/mHhgeGC/soxedemusetekeseduz.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4385862/normal_600edbae70770.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/nuxepiduded/2441333290.pdfIn PDF document text
    • https://s3.amazonaws.com/tedowafomaru/newipanow.pdfIn PDF document text
    • https://s3.amazonaws.com/xukanomarexumu/zafogizipineladozuvu.pdfIn PDF document text
    • https://s3.amazonaws.com/fajeloninesitel/how_to_hard_reset_ipod_nano_4th_generation.pdfIn PDF document text
    • https://s3.amazonaws.com/widiku/xuwojaj.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000101dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x101DC 5404 bytes
SHA-256: 21c9d82d931e9373744d440b4edbe4b2e5f52e115f449b9b4621bea6dba9ffdb
font_01_sfnt_off0001142c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1142C 10788 bytes
SHA-256: c3ca611c43eb8269f05ce8689f445702927d1bb1cc778285fe8f790b0c1bb3eb

Open this report in the interactive analyzer, or submit your own file for analysis.