Malicious PDF — malware analysis report

Static analysis result for SHA-256 be30a6681d089ebc…

MALICIOUS

PDF

111.5 KB Created: 2021-07-04 20:08:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 24a7717ded137c0313e1d6c63faf5357 SHA-1: 53c523743507c1f439b895fa763d8aa72d6f4947 SHA-256: be30a6681d089ebcc21280ac18c7640063da73a90565c9828c618f412627559c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. The presence of numerous embedded URLs, many pointing to PDF files hosted on potentially compromised websites, suggests an attempt to redirect users to malicious content. While no scripts were explicitly extracted, the PDF structure itself may contain malicious JavaScript intended to facilitate the download or execution of further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9852

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bdsvieclam.com/upload/files/gobaferen.pdf
    • http://www.festivalmarrakech.info/wp-content/plugins/formcraft/file-upload/server/content/files/1609ef831db496---gosidupojibenidosesupimup.pdf
    • http://bellezaeimagen.com.mx/wp-content/plugins/formcraft/file-upload/server/content/files/160b3afea0cd10---10645348975.pdf
    • http://www.immiflex.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ef52d8d33f---80415468770.pdf
    • https://farmaciasacoor.com/site/upload/file/37533568780.pdf
    • http://ne-moloko.ee/wp-content/plugins/super-forms/uploads/php/files/cd8ff98336816c32a192232058e81b9a/15572273136.pdf
    • http://www.oknookna.pl/wp-content/plugins/formcraft/file-upload/server/content/files/1609d24d69b0e4---fonalaj.pdf
    • http://for-rent-leuven.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609c06eb06bb3---wuxedaguzojekovapujulu.pdf
    • https://wcdt.co.th/wp-content/plugins/super-forms/uploads/php/files/oe9sd1kldp9a568taoohq5vg83/tovogodutazewodekazaj.pdf
    • http://elm3rad.comfile/84437584393.pdf
    • http://www.orarestauratorisaf.it/wp-content/plugins/formcraft/file-upload/server/content/files/1607060ad73c41---16039879267.pdf
    • http://asijskepotraviny.cz/files/file/sirepozokemezar.pdf
    • http://www.ddd-iasi.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1609c6205caace---18417468577.pdf
    • https://mercedesmazo.es/wp-content/plugins/formcraft/file-upload/server/content/files/160c5ae9d6f722---tigalofepabe.pdf
    • https://planet-pvc.com/upload/files/92750792920.pdf
    • http://www.canadavisaservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607b80f6ec030---25672095294.pdf
    • http://solidpractise.com/files/userfiles/file/52791893227.pdf
    • https://mediabandit.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608ed413dafb4---potudewanapizafe.pdf
    • https://fastcomputer.vn/wp-content/plugins/super-forms/uploads/php/files/34aa45b28c347e73e469078e66adc327/puxute.pdf
    • http://alarcon-v.com/editor_upload_image/file/kezomoxopotogireka.pdf
    • http://lucann.com/Upload/file/48152939478.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/cv9VXjIrmdE/uplcv?utm_term=flirter+meaning+in+english
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000efcb.bin
2bda38824d1881dceded0daa466d1b4bcd75475b10d14de1f0c47a9fff2dbded		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFCB 10412 bytes
font_01_sfnt_off0001071c.bin
51a13713be0953d76b7c5b373fac7fa8d7b1f7a6427f978028078939764ca008		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1071C 29440 bytes
font_02_sfnt_off00014c7b.bin
5408822041326662174df9bac36feb2008f2b93df967cb5f8c19a3d511bd4531		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14C7B 26364 bytes
font_03_sfnt_off00017d97.bin
097b49fe9281077bb368b141905722c5e6937e0dbd0d94cce464d2d1a2e2db8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17D97 7760 bytes
font_04_sfnt_off000197c3.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x197C3 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.