Malicious PDF — malware analysis report

Static analysis result for SHA-256 c06787b8e8d2cff7…

MALICIOUS

PDF

77.4 KB Created: 2021-04-03 14:00:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e57bde720ffb8da60a4c4d90f1e6c85e SHA-1: d21eea2323aff2bb3ce778765a62459003cbcee4 SHA-256: c06787b8e8d2cff7a85458795861715496ddbebfd090d2360388e2c389865160
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ML classifiers and ClamAV. It contains an embedded URL that leads to a suspicious domain, likely intended to deliver a phishing page or a secondary payload. The document body is heavily obfuscated and appears to be generated by wkhtmltopdf, suggesting it's not a typical user-created document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/award?keyword=auditing+notes+for+b.+com+2nd+year+pdf
    • http://xafukuxovikovu.22web.org/game_attack_on_titan_di_android_offline.pdf
    • https://rimemukevip.weebly.com/uploads/1/3/4/3/134318995/nifujofaw.pdf
    • https://tesitibu.weebly.com/uploads/1/3/4/7/134712385/3228072.pdf
    • https://lupoleleki.weebly.com/uploads/1/3/4/5/134516255/rawujubejuzu.pdf
    • https://mukekevujawova.weebly.com/uploads/1/3/0/9/130969498/8677350.pdf
    • https://pilinasovoda.weebly.com/uploads/1/3/4/1/134132167/dopakopuvav-batofodazavotol-kujis-fivedamu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • https://uploads.strikinglycdn.com/files/00b8dbac-4476-408e-849e-bf8bbebdbd0e/what_occurs_at_the_cathode_of_a_galvanic_cell_made_with_magnesium_and_gold.pdf
    • http://sezesub.epizy.com/admission_form_aiou_m._ed.pdf
    • https://s3.amazonaws.com/lawakux/captain_tsubasa_game_for_pc.pdf
    • https://s3.amazonaws.com/rilexazejuzovep/du_battery_saver_pro_apk_old_version.pdf
    • http://xixizojefojedo.rf.gd/tetemizebuwizeku.pdf
    • http://roniwixanedif.epizy.com/steps_to_perform_cpr_american_heart_association.pdf
    • https://uploads.strikinglycdn.com/files/eb993cca-de60-47b8-9e07-d3164a19a16a/88442592874.pdf
    • http://rafubapon.epizy.com/74677404253.pdf
    • https://s3.amazonaws.com/jijari/pubupewinan.pdf
    • https://5c09c65f-4728-49e3-9562-8692e696fc4f.filesusr.com/ugd/32acb1_4802893465e044688f67171c941e1233.pdf?index=true
    • https://02796127-04ec-4c85-b270-c6f7310ebb18.filesusr.com/ugd/ce0e6d_7bd54198b9a84245ba2a6dc39706a0f9.pdf?index=true
    • https://8e0cabef-d481-4215-b437-8a5fc4e4723c.filesusr.com/ugd/f41140_94d57b0a60a14003832cf9a181595bbd.pdf?index=true
    • http://karachiboardnotes.blogspot.com/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dbc1.bin
ba6949423b7de7dc5483a249d1d9154ab800884e12dcb929b561c068176830b0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDBC1 5836 bytes
font_01_sfnt_off0000efa3.bin
4582569b33c97b277fc41f74e909fc1a1ba653600153960ada93217a8dc4abe9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFA3 10804 bytes
font_02_sfnt_off000114ca.bin
2ca6e96fc357878e488d9cfdf438ca779e623fd83e9dbc9a6f166dbfe90701ba		 pdf-font-stream PDF embedded font (sfnt) at offset 0x114CA 5376 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.