Malicious PDF — malware analysis report

Static analysis result for SHA-256 bdb60a5b8937c847…

MALICIOUS

PDF

247.1 KB Created: 2021-04-08 08:08:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: afd3f3fa0cb176b417b89057c6a63a95 SHA-1: ddf103c187e6e4cb5d66e3c98d90f22a62619014 SHA-256: bdb60a5b8937c847c98a3b2fe7a9545653cd8ff5a4eee9783210c85e1653d992
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The embedded URI points to a suspicious domain, likely for phishing purposes. While no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site, aligning with spearphishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9875

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/123?utm_term=calendario+liturgico+2018+chile+pdf
    • https://cdn-cms.f-static.net/uploads/4460465/normal_60460a1cc46f7.pdf
    • https://cdn-cms.f-static.net/uploads/4389805/normal_605a69e1e4e77.pdf
    • http://hamlikjorettoop.ru/how_to_connect_directv_app_to_smart_tvb3g8u.pdf
    • http://negozio50sconto.info/manual_casio_privia_px_160xceez.pdf
    • https://cdn-cms.f-static.net/uploads/4374682/normal_60461eeea3c8b.pdf
    • https://static.s123-cdn-static.com/uploads/4366401/normal_5fde923b1a86b.pdf
    • https://cdn-cms.f-static.net/uploads/4501810/normal_606240c283330.pdf
    • http://tevfikyuce.xyz/amazing_world_of_gumball_characters_as_zodiac_signs2jmdi.pdf
    • https://static.s123-cdn-static.com/uploads/4408712/normal_5fde8c9153392.pdf
    • https://cdn-cms.f-static.net/uploads/4381988/normal_60253d319ead3.pdf
    • https://static.s123-cdn-static.com/uploads/4379385/normal_5ff57497c17c2.pdf
    • http://setofexperience.site/how_to_install_leg_pulley_on_total_gymtdmcc.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://b64dd490-e5b9-492f-89ff-e398ecee904c.filesusr.com/ugd/5926b4_4319787689c44355a17a26dbe237e7d0.pdf?index=true
    • https://6d4a8fb0-9a8a-4850-8aa1-2b5706121c9a.filesusr.com/ugd/ff2e72_5ad6b814b0d449b8aa293ab6f4f8c2d6.pdf?index=true
    • https://2ed821ec-8078-4e74-b11b-c5cec6a88262.filesusr.com/ugd/65e777_359f2cb5b36c4ecba3ba9053931e9c67.pdf?index=true
    • https://cabae152-0d18-4cc7-9545-8711a89e332e.filesusr.com/ugd/607e04_976c9c594f254e878c91b996a4161437.pdf?index=true
    • https://4253c66a-660d-4c83-b31d-f715833d547b.filesusr.com/ugd/d9e9a0_b2103169ada24e94ab5461b53edc716d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b1a47b30-805c-46ac-a9f9-b1bd3c213c54/46885312751.pdf
    • https://b3d988c2-7a7d-4c3c-9141-221b6550481e.filesusr.com/ugd/9dda13_3fd3a0872275453ab054fb4348ad6f1f.pdf?index=true
    • https://e6a48395-9ebc-465e-8505-c4b20d7b8e72.filesusr.com/ugd/81e12b_d8df4e56b5574edcbc909d93eb4dcc0e.pdf?index=true
    • https://5bf49506-6ef1-42f8-8f90-7e3689255fd3.filesusr.com/ugd/8fe1bf_c9481ff31625441794237d23feb6917b.pdf?index=true
    • https://5e7fdb44-65a6-4d88-9b36-b69c04d36e08.filesusr.com/ugd/b547b4_085ef67a773840149bdd2de7a574ecb3.pdf?index=true
    • https://uploads.strikinglycdn.com/files/68db9f7a-a0ae-4b1e-8b70-aa274a1ba49a/why_is_there_a_black_spot_on_my_tooth.pdf
    • https://694dae7a-2033-4a59-8b06-91ff4eec0774.filesusr.com/ugd/e1d58f_56b7682db0684bb1b32d8c14b9c99194.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00038fb0.bin
b4af64ab65213271bc24e3eccec4cb04fe0cf81face4335c5ff8c1a54c20416a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x38FB0 5664 bytes
font_01_sfnt_off0003a2f0.bin
edfd6aea8b3488ddd6f085e28267c927b25fa5a92be3a7a829700a214af8e33c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3A2F0 13516 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.