Malicious PDF — malware analysis report

Static analysis result for SHA-256 bf68c2e958373533…

MALICIOUS

PDF

86.5 KB Created: 2021-03-22 14:00:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 3be2d2a64e9f095e1a5f2ff615e982ef SHA-1: c44ce4f34d1b957ca8b34a6d1b8bf194d717dc0c SHA-256: bf68c2e958373533a2bbea5de6c6b70faa560edf8f6e3c98f65976677a4ca4b3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a critical heuristic flagging it as Pdf.Phishing.Trojan. The embedded URL points to a suspicious domain, and the document body, though obfuscated, contains keywords related to the URL, suggesting a lure. No scripts were extracted, but the presence of external URIs and the overall detection profile indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/award?keyword=cancer+de+pulmon+radiologia+pdf PDF link annotation
    • http://liwexun.mywebcommunity.org/amleto_di_shakespeare.pdfIn PDF document text
    • http://viniveba.mywebcommunity.org/free_download_mp3_ost_the_heirs_full_album.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4482403/normal_6048f16954301.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4448545/normal_604aa8bde8b2d.pdfIn PDF document text
    • http://gevejune.iblogger.org/livro_qumica_orgnica_experimental.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4459337/normal_5fcf8002247c9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408460/normal_60386d55d9360.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417834/normal_601b69ec12369.pdfIn PDF document text
    • http://fontawesome.iohttp://fontawesome.io/license/In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jezekemunidup/53827325514.pdfIn PDF document text
    • https://s3.amazonaws.com/folexapurilowe/751388635.pdfIn PDF document text
    • http://fivadez.rf.gd/frys_300_sight_words.pdfIn PDF document text
    • https://s3.amazonaws.com/julaxel/android_studio_install_ubuntu_16._04.pdfIn PDF document text
    • https://s3.amazonaws.com/bisiku/75737290470.pdfIn PDF document text
    • https://s3.amazonaws.com/fobupojowojon/t_sql_index_fragmentation_report.pdfIn PDF document text
    • http://zoletiwosi.rf.gd/baazaar_full_movie_480p_filmyzilla.pdfIn PDF document text
    • http://kaxogesidod.epizy.com/xazojukezi.pdfIn PDF document text
    • http://kuwajakuxoj.epizy.com/3837024681.pdfIn PDF document text
    • http://rovijog.rf.gd/boatswain_mate_manual_14343a.pdfIn PDF document text
    • http://mepumazat.epizy.com/70221311444.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010a32.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A32 1992 bytes
SHA-256: 3c6d48e5a4736d2d9be8ca5ca25dfc5ac8ba1336b9d767165b259ded63133303
font_01_sfnt_off000113ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x113AC 5204 bytes
SHA-256: d85115a69cc9277f386670b9804fcbe5310e486594a2cb7ac7a0201e7bb44899
font_02_sfnt_off00012548.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12548 11844 bytes
SHA-256: 8ab16e8a4c203c2f917f875d6f3df793a7ed02b184e7f8e853723f01b83d5264

Open this report in the interactive analyzer, or submit your own file for analysis.