Malicious PDF — malware analysis report

Static analysis result for SHA-256 bb844d7c8d73f566…

MALICIOUS

PDF

82.1 KB Created: 2021-03-23 11:27:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 65621b7e150412ef87f501b9e02bf360 SHA-1: 71d4247b73779bac9d44921d6dfe8f1e41403e4f SHA-256: bb844d7c8d73f566fa4fe73dc89053c9082a1a3f1f0d31f757fd1285f505d4e6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, which is a strong indicator of a phishing or malware distribution attempt. The ML classifier and ClamAV detection further support its malicious nature. Although no scripts were explicitly extracted, the PDF structure and embedded URLs suggest it's designed to redirect users to malicious content, likely for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/award?keyword=hernia+umbilical+bovinos+pdf
    • https://cdn-cms.f-static.net/uploads/4366642/normal_5fda2270a2770.pdf
    • https://cdn.sqhk.co/bibolaned/3id8ege/oscar_de_la_renta_wedding_dress_for_sale.pdf
    • https://cdn-cms.f-static.net/uploads/4381091/normal_602499424072e.pdf
    • http://gejokakop.mygamesonline.org/27709050609.pdf
    • https://kogababofaf.weebly.com/uploads/1/3/0/9/130969162/vawadexox.pdf
    • http://fikosarodone.medianewsonline.com/tch_trang_file_online.pdf
    • https://dakubazelup.weebly.com/uploads/1/3/1/4/131454222/muralobow.pdf
    • https://wokumedepawal.weebly.com/uploads/1/3/4/6/134607606/6625419.pdf
    • https://cdn.sqhk.co/naxetimi/ffoBEii/41746012139.pdf
    • https://static.s123-cdn-static.com/uploads/4401692/normal_5fcbf85037065.pdf
    • https://cdn-cms.f-static.net/uploads/4382952/normal_602cb1707ac72.pdf
    • https://static.s123-cdn-static.com/uploads/4387581/normal_5fffb6785fa4b.pdf
    • https://cdn-cms.f-static.net/uploads/4392649/normal_603c2cfc3c3ab.pdf
    • http://lovupijuti.getenjoyment.net/jvc_kd-r200_set_clock.pdf
    • https://static.s123-cdn-static.com/uploads/4473656/normal_6000a30dbd19b.pdf
    • https://cdn-cms.f-static.net/uploads/4462376/normal_600db4b329b7a.pdf
    • http://movawizaxaxato.mywebcommunity.org/intex_sand_filter_pump_instructions.pdf
    • https://static.s123-cdn-static.com/uploads/4449614/normal_5ffc9862a548d.pdf
    • https://static.s123-cdn-static.com/uploads/4376098/normal_6008962fcbe5d.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/fuvidokibet/2762485616.pdf
    • https://s3.amazonaws.com/fopalew/71288709987.pdf
    • https://s3.amazonaws.com/genukopapovixo/68775785465.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f81e.bin
d7cf394e193678ce12ed0085895a36657ba664d44a0ca1b40e5ec5f77cecf0be		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF81E 5264 bytes
font_01_sfnt_off000109d1.bin
4fc6d8aef37ff96e3b0a83afba24640aaefda1d31edde54e6f9c5da5b0c8028a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x109D1 10276 bytes
font_02_sfnt_off00012d02.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12D02 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.