Malicious PDF — malware analysis report

Static analysis result for SHA-256 c011b2d3f4836cba…

MALICIOUS

PDF

70.3 KB Created: 2021-02-06 15:20:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: cd6563942a542050b5ff81445843da13 SHA-1: 5686de2366ce85bd48ddfbe33c8c10dbc62f228c SHA-256: c011b2d3f4836cba81ede202eb53c7f4c4514c01ca1ce65fa25c980834b6807b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF with a high ML classifier score and a critical ClamAV detection indicating it is a phishing trojan. It contains an embedded URL pointing to a domain that is not confirmed benign, suggesting it is used to host or redirect to malicious content. The document body, though heavily obfuscated, contains references to 'Business card editor free' and 'wkhtmltopdf', indicating a lure to disguise the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/aws?utm_term=business+card+editor+free PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4451545/normal_5fda2a6fa2755.pdfIn PDF document text
    • http://winsbig.space/marvel_strike_force_fear_the_darknesckxef.pdfIn PDF document text
    • http://busforpay.online/principles_of_ophthalmic_lensesbuli8.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4393791/normal_5fdf0274c0bf8.pdfIn PDF document text
    • http://yozi.store/torentz2._eu_enginezrs1k.pdfIn PDF document text
    • http://saudiautoinsurance.com/drag_sports_bike_wallpapers_for_desktop5qulz.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/zunewidimem/arjun_abhimanyu_kannada_movie_songs.pdfIn PDF document text
    • https://s3.amazonaws.com/xakapudakadu/zowufemawututenobu.pdfIn PDF document text
    • https://s3.amazonaws.com/telasebisu/army_dress_uniform_costume.pdfIn PDF document text
    • http://petobesafena.rf.gd/10828557995.pdfIn PDF document text
    • https://s3.amazonaws.com/webipejonavuv/21640055059.pdfIn PDF document text
    • https://s3.amazonaws.com/xasovewipeje/lutazurariw.pdfIn PDF document text
    • https://s3.amazonaws.com/fikuvine/pogogifufegopod.pdfIn PDF document text
    • https://s3.amazonaws.com/didowugorokirug/xetaxifalasuz.pdfIn PDF document text
    • https://s3.amazonaws.com/betefowubevat/gejuvuvubelot.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d8fc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD8FC 5032 bytes
SHA-256: 65fbb71ff1897c96f77f1481fa31658551b8f0716671c1816c6d311d4a5c18e1
font_01_sfnt_off0000ea2b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA2B 10032 bytes
SHA-256: 9d6a347f9014bf42523a65fa40306a3e5edd4ae6f840d61bee4fb24831bb6a14

Open this report in the interactive analyzer, or submit your own file for analysis.