Malicious PDF — malware analysis report

Static analysis result for SHA-256 ba849d89ec1fc072…

MALICIOUS

PDF

71.8 KB Created: 2021-03-20 00:09:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e486b9c01ba7b071da9208cf548ec5e6 SHA-1: 2e7491a2c2c971c1d20d88293acae699cb20b64b SHA-256: ba849d89ec1fc0728167c2351b269d462ae7ca74b5657474de4dd205432125ee
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URI points to a phishing domain, suggesting the PDF is used as a lure to direct users to a malicious website. No scripts were extracted, but the PDF structure itself contains malicious elements.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=ap+macroeconomics+review+guide
    • https://teniroge.weebly.com/uploads/1/3/4/6/134693228/24642a0.pdf
    • http://macsk.space/technical_sales_engineer_resumefbd2c.pdf
    • https://static.s123-cdn-static.com/uploads/4469834/normal_5ff0a55cabcac.pdf
    • http://uabiomanix.xyz/what_is_the_definition_strip_croppingu7761.pdf
    • https://tebojizo.weebly.com/uploads/1/3/1/4/131406069/b5ba4da.pdf
    • http://vulgargirls.fun/homers_iliad_and_odyssey_the_essential_booksghwnq.pdf
    • https://tuxufinuzeleki.weebly.com/uploads/1/3/4/7/134737217/madigomokofedoj.pdf
    • http://tells.fun/zumixokewusaruxisurafibejnmxb.pdf
    • http://espaceabone.com/adobe_reader_create_onlinejdd4t.pdf
    • http://discount50.pro/70877213877ggapx.pdf
    • http://a1metromovers.com/874391892211d2ky.pdf
    • https://lidovoji.weebly.com/uploads/1/3/4/3/134313359/4312c.pdf
    • http://realwockyc.info/automotive_supervisor_jobs_near_meb5ch0.pdf
    • http://damvglaz0.xyz/physiotherapy_exercises_for_upper_back_painhfg8t.pdf
    • https://static.s123-cdn-static.com/uploads/4373983/normal_5fe0ca61d5a65.pdf
    • http://mignonette.space/poster_design_template_ai_freertndd.pdf
    • http://meetchat.space/the_three_basic_needs_in_self-determination_theory_are_blank_blank_and_blanky9iu9.pdf
    • http://ridunculus.com/41254899716248gv.pdf
    • http://mestikon.online/troy_bilt_pony_throttle_linkageqif4z.pdf
    • http://cocobuka3.xyz/milk_chocolate_brownies_boxzdtb3.pdf
    • https://cdn-cms.f-static.net/uploads/4467573/normal_5fd1ff3bbda41.pdf
    • https://cdn-cms.f-static.net/uploads/4415946/normal_602beed59231a.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://44eeb0f0-4dc9-4d8b-b3fd-cc7ace98e90e.filesusr.com/ugd/a083a1_8ed7179cf25a43b6bc279bb6a766bc1b.pdf?index=true
    • https://275320ff-96dd-455a-9699-a0fdc58b27a5.filesusr.com/ugd/943725_1fee41cba11543c7953272dff5498fe6.pdf?index=true
    • https://4cf6c2b4-cd84-4b73-83b1-bf7f441162b2.filesusr.com/ugd/e50c99_2b345ae6864943e4bdbc96a777a14178.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d6f2.bin
00b99c6bcf8bd076a1fead46376f27f8497807c5c1554ecc3007d94152e44630		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD6F2 5504 bytes
font_01_sfnt_off0000e9a2.bin
f33ce981bbef3cce01d629cd4dc1b1c9958ca56c7cc985f0e5b9c1ea27431b9f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9A2 11232 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.