Malicious PDF — malware analysis report

Static analysis result for SHA-256 c0119d1515c426c3…

MALICIOUS

PDF

70.3 KB Created: 2021-03-27 11:05:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 0d4e8e289c2436c774173aca3bb220ef SHA-1: 7db23fa05c4ea6df808ddf085f99d06b75cb643f SHA-256: c0119d1515c426c3bbb44232aea71a58eeed6d07011f349e7f4b6f37957bce74
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to a suspicious domain, likely used as part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to PDF conversion tools, aligning with a spearphishing attachment attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/award?keyword=pdf+to+word+converter+offline+app+download PDF link annotation
    • http://wide-take.top/vigarurilofevazupidifofioj0a.pdfIn PDF document text
    • http://mananeje.66ghz.com/how_much_does_laundry_service_cost_in_nyc.pdfIn PDF document text
    • http://allmedbook.com/rotator_cuff_surgery_recoveryuk8ha.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/zetubakuz/tebekavozazipewifupotu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ff578935-9f1b-4ce3-9b6d-2c7cfbf1275a/how_to_restart_casio_fx-115es_plus.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/07c0075a-49a2-4da4-bac1-3704ac772e44/82763032937.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/546cca45-6da5-491a-bfc2-46fcf70ca263/rebis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/23db32cc-ec46-4896-8ce0-56ba4d929d02/pezulerefoxugutesomonepi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/812c0b8b-6b07-4353-92f8-d64be639d400/3406021449.pdfIn PDF document text
    • https://s3.amazonaws.com/kavalukato/dixakurebevakebuwuviju.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9fa8f85d-c26d-45b1-9d8c-c23f7ac49de2/7846963213.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/74753b64-7318-4145-921c-d7662b01ecde/las_medias_de_los_flamencos_cuento_completo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fcf38d3b-c54b-4222-80b8-ec345ff4b82b/butuwewadonuzijobuf.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c769044c-0285-445a-b768-56d5bc3b015f/sugima.pdfIn PDF document text
    • https://s3.amazonaws.com/debiwelof/95650555488.pdfIn PDF document text
    • https://s3.amazonaws.com/suximawo/fto_search_report_sample.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a9528d0e-99cc-4ce5-a841-285d7b211ad6/90664612193.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4dae9d30-39ca-44c9-97df-294565f8a7ca/what_is_chapter_1_about_in_lord_of_the_flies.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/55eb7210-e367-4b5c-bad2-b7a7d96cd260/zemilosajividexop.pdfIn PDF document text
    • http://jovukanuwu.rf.gd/zarekirobexani.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d5e7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD5E7 5124 bytes
SHA-256: 8ecd957d08947d07955434229a8c208d07605e5b2482b6fd151c19891f418227
font_01_sfnt_off0000e780.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE780 10676 bytes
SHA-256: d7f61d145c7f9b3c3ba8d518cc7e75dc8498f36805ffc2b8c42f03e9acd4cc86

Open this report in the interactive analyzer, or submit your own file for analysis.