Malicious PDF — malware analysis report

Static analysis result for SHA-256 bf996c10b7068a15…

MALICIOUS

PDF

70.9 KB Created: 2021-03-08 14:48:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 166f36f7ac5f3bdce9a677f1b16bb08a SHA-1: 9dda3ffc6306f44992aac45ce58afe5f111e00cc SHA-256: bf996c10b7068a15f1b4c2b8e6de6af1a6ccc0495b9d6713d725d83c401f4776
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded external URI pointing to a suspicious domain, likely intended for further exploitation or credential harvesting. The PDF structure and embedded content suggest a phishing or social engineering lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/123?utm_term=bandobast+video+songs
    • https://cdn-cms.f-static.net/uploads/4370778/normal_602db36ca4a74.pdf
    • https://static.s123-cdn-static.com/uploads/4481676/normal_600909479b206.pdf
    • https://cdn.sqhk.co/temejikowewa/5Z8pjjc/what_does_a_wolf_sound_like.pdf
    • https://cdn-cms.f-static.net/uploads/4463010/normal_600e85f1bfb40.pdf
    • https://cdn-cms.f-static.net/uploads/4392444/normal_600f0a10eadae.pdf
    • https://cdn-cms.f-static.net/uploads/4416144/normal_60207c3b38b8e.pdf
    • https://cdn-cms.f-static.net/uploads/4388271/normal_603265cca9b11.pdf
    • http://zazorin.scienceontheweb.net/neverending_story_horse.pdf
    • http://lulopoboxefon.scienceontheweb.net/17199339863.pdf
    • https://cdn-cms.f-static.net/uploads/4446770/normal_60446c5a3e500.pdf
    • https://cdn.sqhk.co/fabokofe/Wjfihvq/kikoburasipodareb.pdf
    • https://cdn.sqhk.co/gotofebelu/bjdqibW/mega_millions_winning_numbers_history.pdf
    • https://cdn.sqhk.co/tovipovo/ZjbkNhj/somom.pdf
    • http://konalofasu.mywebcommunity.org/can_i_negotiate_car_lease_terms.pdf
    • https://static.s123-cdn-static.com/uploads/4415068/normal_5fe32a37073f7.pdf
    • http://gisoboxizaza.mygamesonline.org/13397963316.pdf
    • https://static.s123-cdn-static.com/uploads/4477401/normal_5fc95d18af28a.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://2a4065d7-883d-43e8-a524-7ce9aa4b4e88.filesusr.com/ugd/ccb1c6_674bd713139e420d876ec6d55c4fc3fb.pdf?index=true
    • https://uploads.strikinglycdn.com/files/cc5a96a8-6123-4db2-8bc4-969d12077141/i_pilot_remote_pairing.pdf
    • https://c63ca81c-6df4-4ec3-bc2e-8508f29a6879.filesusr.com/ugd/d48fe3_84d64e4c0de94f30aa0da078416d8342.pdf?index=true
    • https://uploads.strikinglycdn.com/files/4e015164-6fff-4465-9554-e26ce6ba379f/where_is_the_oil_filter_located_on_a_2009_toyota_corolla.pdf
    • https://d5fd0048-bb8d-45a1-ba21-28d1cb0b7162.filesusr.com/ugd/5e8de6_13faf82ab4ba4a6e89fa976ec09bfa6f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ed39f0a3-68b9-422d-ae97-ca9b23a016cd/can_you_bulk_on_3000_calories.pdf
    • https://5a1138df-423b-4a5d-a7c7-36223740754e.filesusr.com/ugd/a72fa8_21ae1194e6ff463ea479413a564ad87b.pdf?index=true
    • https://3e3188f7-d9e9-48da-9af6-4e6760718ee0.filesusr.com/ugd/4f7562_1735afcc821d4dd792dd10bc7f64bb70.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d827.bin
310d5743c5cb4d347211e23d0d246669b37b6a86c350e6e875ba7097096f10a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD827 5116 bytes
font_01_sfnt_off0000e9aa.bin
95313127e154b38eaf916d8470775ae0de37182a0d58c7210482bc4d1359ab4a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9AA 10696 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.