Malicious PDF — malware analysis report

Static analysis result for SHA-256 ba544c10d60a190b…

MALICIOUS

PDF

79.2 KB Created: 2021-03-28 07:13:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dc704f3306c9ad1571f838b7fb23de2a SHA-1: 2465f6bd9174382f014c138710a8a25be7bc3dc5 SHA-256: ba544c10d60a190b9ea6203cd89e62ea262738e6578a7a2ce32efe4925ffb267
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to a suspicious domain, suggesting it's designed to redirect users to a phishing or malware site. The document body, though heavily obfuscated, contains keywords related to tax documents, indicating a lure to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/award?keyword=tabela+anexo+i+simples+nacional+2020+pdf
    • http://siwupezomejen.getenjoyment.net/appendix_c_chemistry.pdf
    • http://opssmall.space/96933158019gchch.pdf
    • http://leoidet.xyz/lg_washing_machine_video_reviewmsc53.pdf
    • http://marketitaly.info/how_to_delete_adobe_acrobat_reader_dc_from_macd66ls.pdf
    • http://profer-opt.ru/2287913590154ka2.pdf
    • http://dasiwujupuna.sportsontheweb.net/82571332318.pdf
    • http://budokudepa.scienceontheweb.net/89178384178.pdf
    • http://copriyghtconfirmed.com/74099192225bcxxu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://noroved.myartsonline.com/what_influences_health_behavior.pdf
    • https://s3.amazonaws.com/dutuzanob/21848602138.pdf
    • https://uploads.strikinglycdn.com/files/6071f271-3227-4225-9de9-cb67d6db0866/simcity_4_deluxe_cd_key_chomikuj.pdf
    • https://uploads.strikinglycdn.com/files/0d678886-95b4-42f6-aa03-85fd53d68d29/93628872760.pdf
    • https://s3.amazonaws.com/zowibatev/data_structures_and_algorithms_video_lectures.pdf
    • http://fawivemepogu.epizy.com/54471139535.pdf
    • https://s3.amazonaws.com/kizugokofo/new_england_middle_and_southern_colonies_worksheet.pdf
    • https://uploads.strikinglycdn.com/files/f8fee78e-f20a-4704-ada1-1660e4cae634/87143546339.pdf
    • https://uploads.strikinglycdn.com/files/62d34f52-d811-404f-b338-3f8a635204db/1998_ford_explorer_transmission_replacement_cost.pdf
    • http://kemeterotef.rf.gd/civ_6_deity_guide.pdf
    • http://jibogifimot.epizy.com/74035952153.pdf
    • https://uploads.strikinglycdn.com/files/72fbaa79-3da3-460e-8d26-0bf7d0d41416/53464275234.pdf
    • https://uploads.strikinglycdn.com/files/523b66db-c31a-4ce5-a931-1a0f3d654b92/why_wont_my_answering_machine_pick_up.pdf
    • https://uploads.strikinglycdn.com/files/b6071ec9-8357-44d6-b9c5-4c43ad8b53c4/91648980043.pdf
    • http://jumepenitujox.atwebpages.com/70683164324.pdf
    • https://uploads.strikinglycdn.com/files/46a199ea-cedd-4822-9fca-9d27b4e27760/galenusimobinaw.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f1ab.bin
a759ea9c9c21a0da46646af82219f98d2e7258b909abc0b888a9002b5ddf00e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF1AB 5636 bytes
font_01_sfnt_off000104c7.bin
acaec38dc3064d5b71097d0831910f45219e41f38a91e9c1762d71cb763e8900		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104C7 13280 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.