Malicious PDF — malware analysis report

Static analysis result for SHA-256 c61ae6c38edd5889…

MALICIOUS

PDF

80.6 KB Created: 2021-04-07 11:12:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 54b7f2b15b41821dd00ec5b0a58bf0de SHA-1: e2b7e5422732a841964c969f46a7e840dd48d644 SHA-256: c61ae6c38edd5889fcdea492630cbe874a341a98346fc2343703be27763b4b71
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a malicious domain, likely for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, appears to be a lure related to a technical document, suggesting a spearphishing attachment attack vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wix?keyword=space+propulsion+analysis+and+design+ronald+humble+pdf
    • https://cdn-cms.f-static.net/uploads/4490266/normal_5fd1b7fdb2697.pdf
    • https://cdn-cms.f-static.net/uploads/4368781/normal_6022c3611f867.pdf
    • https://cdn-cms.f-static.net/uploads/4387060/normal_600b6133d816d.pdf
    • http://serovakarara.mygamesonline.org/jokafov.pdf
    • http://leninuludobodu.mygamesonline.org/44734978493.pdf
    • http://xejitifuwoligaf.mypressonline.com/44839804798.pdf
    • http://wabaxifejem.sportsontheweb.net/sewisuroxodum.pdf
    • http://tifoxikutawe.sportsontheweb.net/woolworths_application_form.pdf
    • https://cdn-cms.f-static.net/uploads/4410211/normal_5fdbfa6331770.pdf
    • https://cdn-cms.f-static.net/uploads/4408989/normal_605018b42e121.pdf
    • http://mofemaruwek.sportsontheweb.net/the_secret_garden_full_movie_1949.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/mokamoba/catalogo_hinode_2018_ciclo_3.pdf
    • https://uploads.strikinglycdn.com/files/7aec0015-b54a-4199-a726-dbe152636d05/90_gramos_a_ml_mantequilla.pdf
    • https://uploads.strikinglycdn.com/files/6c082dce-dad6-457e-bbc2-5449867b185e/xowazagarulutarifow.pdf
    • https://uploads.strikinglycdn.com/files/c666181d-bdb7-4e6f-8297-6c20f671047a/fanuromupabisakanum.pdf
    • https://s3.amazonaws.com/fuwenoxuzasila/batman_pc_game_highly_compressed.pdf
    • https://s3.amazonaws.com/wamatasamegu/unstable_angina_guidelines_2016.pdf
    • http://xowobovu.myartsonline.com/146448358.pdf
    • http://bavatesivo.myartsonline.com/nios_dled_assignment_cover_page_download.pdf
    • https://uploads.strikinglycdn.com/files/c63b4a0d-aa22-4ca6-9bed-6540ba1713a6/kitchen_pro_bread_machine_manual.pdf
    • http://solarujarinobo.myartsonline.com/antimicrobial_activity_of_garlic.pdf
    • http://wovodijulenape.onlinewebshop.net/bowling_for_columbine_analysis.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc73.bin
f5c418cb1a5eb0dc4c5796cff374decc418a9fe1814e7a81b17808a55ac892c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC73 5912 bytes
font_01_sfnt_off0001106a.bin
ee82a6ecdc271260a25ef7985b1419b7c24287a060a6c829f85178b2793d50cc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1106A 10584 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.