Malicious PDF — malware analysis report

Static analysis result for SHA-256 bd047b4987e74233…

MALICIOUS

PDF

69.7 KB Created: 2021-06-01 04:16:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a91e8ad664f0966c4cb981485f19390a SHA-1: 5c1bec7411d11957a7ce4daad9515c5e89a9727d SHA-256: bd047b4987e742338fb67b81a6112beb8b4136db03958a8410b679cb4729a6c6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that, when clicked, leads to a phishing site disguised as a search result. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URI suggest a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://inwebjor.ru/pbw?utm_term=how+do+you+hack+asphalt+8
    • https://duweliga.weebly.com/uploads/1/3/4/5/134593675/f39ce0647f7da65.pdf
    • https://static.s123-cdn-static.com/uploads/4446026/normal_5feca0de9b285.pdf
    • https://cdn-cms.f-static.net/uploads/4368732/normal_60426fdff0819.pdf
    • https://cdn-cms.f-static.net/uploads/4369305/normal_5fe64057183ee.pdf
    • https://cdn-cms.f-static.net/uploads/4387224/normal_5fd8d47724b3c.pdf
    • https://numevajuga.weebly.com/uploads/1/3/0/9/130969633/cd5ca1f67da46.pdf
    • https://static.s123-cdn-static.com/uploads/4465538/normal_600849547de3a.pdf
    • https://wumetitazidizo.weebly.com/uploads/1/3/4/8/134885052/pejikowunuxolem-zuvusepoveto-kitijoxojodu.pdf
    • https://taxuzigapunup.weebly.com/uploads/1/3/7/4/137499287/jakupoxupota.pdf
    • https://cdn-cms.f-static.net/uploads/4381544/normal_60546bd8eae95.pdf
    • https://pelepidavivi.weebly.com/uploads/1/3/1/4/131454492/rixifage.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://dekokos.pbworks.com/w/file/fetch/144418188/what_is_the_sentence_for_a_class_d_felony.pdf
    • http://mutatalibo.pbworks.com/f/what_are_the_four_effects_of_baptism.pdf
    • http://jesababa.pbworks.com/f/myles_munroe.pdf
    • http://nilanom.pbworks.com/w/file/fetch/144419262/lusagafozapo.pdf
    • https://uploads.strikinglycdn.com/files/2731887e-d411-46c5-ab53-7c020474e273/legezibiluzifu.pdf
    • http://pamotekegopa.pbworks.com/f/cdigos_para_tener_diamantes_gratis_en_free_fire.pdf
    • https://uploads.strikinglycdn.com/files/5853f03f-fc2b-4926-867d-c9b3ff59c250/respond_or_responses.pdf
    • http://godekazonigi.pbworks.com/w/file/fetch/144435447/nefanimebujete.pdf
    • http://jesababa.pbworks.com/w/file/fetch/144424917/23559345681.pdf
    • https://uploads.strikinglycdn.com/files/ba14c76b-e6c9-48dc-bf79-03c2e6a434dc/62179599389.pdf
    • https://uploads.strikinglycdn.com/files/ef4a1519-ef1c-463c-8ca5-a8c8d70400ca/7233768529.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d485.bin
c38cd8af7ead60e0e92e312361c9110454f3c963c351ecf635ea001b0ec70371		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD485 5476 bytes
font_01_sfnt_off0000e73b.bin
ad9a5bec1a751f7d41bcc63827ced084bc67d56ed8bf8044b3fa25750237240e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE73B 9992 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.