Malicious PDF — malware analysis report

Static analysis result for SHA-256 bb683bd898a38dac…

MALICIOUS

PDF

71.5 KB Created: 2021-04-01 00:30:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ce16c8bd49b59e31969e6802e58c57f2 SHA-1: 95aa344ef0d361722fdd2cf52367afe9a6d0fc1a SHA-256: bb683bd898a38dacc3ec45b3a62f85e0187cd403c0cf2f5a1062e34bf214d1e5
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, suggesting a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly indicate malicious intent. Although no scripts were explicitly extracted, the PDF structure and embedded URI are consistent with a phishing lure designed to redirect users to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/award?keyword=vanilla+js+tutorial+pdf
    • http://erkutungotu.com/pg_date_sheet_2019_du_solsk9u0.pdf
    • https://cdn-cms.f-static.net/uploads/4446647/normal_601993b1a3dd5.pdf
    • http://lofajemami.sportsontheweb.net/agriculture_in_tamil.pdf
    • http://doucheapp.xyz/how_to_mix_wella_koleston_with_peroxidejy1px.pdf
    • http://telemprom.xyz/vetekemujenezotu7n3wl.pdf
    • https://cdn-cms.f-static.net/uploads/4529780/normal_6018358157370.pdf
    • http://normaa-id.com/30406851717je9io.pdf
    • https://cdn-cms.f-static.net/uploads/4497697/normal_6018b419d611d.pdf
    • http://zifixoribe.scienceontheweb.net/sadatuwirolozobezilipiluw.pdf
    • https://cdn-cms.f-static.net/uploads/4387701/normal_605ee2a8d35bc.pdf
    • http://ourfutures.space/scrap_copper_prices_per_pound_wisconsinuvtp8.pdf
    • https://cdn-cms.f-static.net/uploads/4370076/normal_6024a1dc3b39c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/02332486-9ba2-40ad-b361-6549c29e3c56/rubimin.pdf
    • https://uploads.strikinglycdn.com/files/3cb6f941-00b8-4012-8330-572733f7f5b5/norton_shakespeare_3rd_edition.pdf
    • https://uploads.strikinglycdn.com/files/3e62a8ce-fd37-4029-9763-29bb92487538/xerox_workcentre_3325_factory_reset.pdf
    • https://uploads.strikinglycdn.com/files/2a184c5e-d4c6-49e0-ac46-d3a7dd729cfa/blackjack_pizza_greeley_order_online.pdf
    • https://uploads.strikinglycdn.com/files/264812b9-4121-410f-b3c3-f789d86413e3/74131400105.pdf
    • https://uploads.strikinglycdn.com/files/996b94a7-12f2-4be2-80d5-a84cd140fdec/.pdf
    • https://uploads.strikinglycdn.com/files/1919a9a5-0e1a-4a0d-891c-da295ff91982/35405318038.pdf
    • http://fogokenum.onlinewebshop.net/a_thousand_splendid_suns_discussion_questions_part_3.pdf
    • https://uploads.strikinglycdn.com/files/ac9a3ea0-1be9-49e8-90e3-72eb0634d300/91997847189.pdf
    • https://uploads.strikinglycdn.com/files/e99ffbbf-e8ae-4620-b518-0f2de81f4fd6/powoluvibur.pdf
    • http://nukivamo.myartsonline.com/xodalukulolajaludekab.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d469.bin
f6e0442f8c9def7dd6e66d9e0dbd6110e5cf3aadd4da7f0dd09b4c07b0c87663		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD469 5076 bytes
font_01_sfnt_off0000e5c5.bin
c7304af68949664974f2118be5d0c547cbabf07f1bf811e33dcddd34f820cc8c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE5C5 13224 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.