Malicious PDF — malware analysis report

Static analysis result for SHA-256 c6299d98a97b3f5b…

MALICIOUS

PDF

80.7 KB Created: 2021-04-06 21:08:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 5d7e8c89a8e27b5d663244dc90b485f3 SHA-1: eea8cd8387564801d8fc39b7e19fcccf39086be4 SHA-256: c6299d98a97b3f5b43a93a38dea2df3b9d6bf17d2a041a21d195beab22d8e6cf
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that leads to a phishing page disguised as information about Asperger's syndrome. The ML classifier and ClamAV detection strongly indicate malicious intent. No scripts were extracted, but the presence of a malicious URL suggests a phishing attempt to redirect the user to a compromised site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/award?keyword=sindrom+asperger+pdf+adalah PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4499995/normal_60369e1f13a37.pdfIn PDF document text
    • http://rowowevu.mypressonline.com/17523576432.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4402938/normal_6057aca4bbd0c.pdfIn PDF document text
    • http://pokinusuvato.getenjoyment.net/hydraulic_pipe_bending_machine_project.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384470/normal_604953b95b4d1.pdfIn PDF document text
    • http://loziwazekon.medianewsonline.com/28_creencias_de_los_adventistas_para_nios.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://nonivomiba.rf.gd/wewofajemesaf.pdfIn PDF document text
    • http://vanuzavabew.epizy.com/leninulitijizadaji.pdfIn PDF document text
    • https://s3.amazonaws.com/palevijuj/79844692569.pdfIn PDF document text
    • http://nejovafejasujob.rf.gd/fasexulesizi.pdfIn PDF document text
    • https://s3.amazonaws.com/gurafoga/31113601984.pdfIn PDF document text
    • https://s3.amazonaws.com/daxemo/sikijov.pdfIn PDF document text
    • http://pikubub.onlinewebshop.net/rowobejenulupujevawetufen.pdfIn PDF document text
    • https://s3.amazonaws.com/pugomonapoxuxe/fraulein_song_sheet_music.pdfIn PDF document text
    • http://ruzizasasasami.rf.gd/beat_the_market_maker_method.pdfIn PDF document text
    • https://s3.amazonaws.com/napoledunadigo/sony_trinitron_tv_model_kv-27s42.pdfIn PDF document text
    • http://jonesojawu.myartsonline.com/83228873097.pdfIn PDF document text
    • https://s3.amazonaws.com/salosibejodod/exponential_functions_growth_and_decay_answers.pdfIn PDF document text
    • http://gataluxogawix.epizy.com/aws_cli_cloudformation_delete.pdfIn PDF document text
    • https://s3.amazonaws.com/gateme/formation_hotellerie_au_canada.pdfIn PDF document text
    • https://s3.amazonaws.com/tesasubawalozan/97300861742.pdfIn PDF document text
    • http://muwadobekele.rf.gd/rifunolimo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef72.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF72 5264 bytes
SHA-256: 986ef046207e4d264f4e60c4936d2318aca9ddd4dfcebee58c1a8c9d4f345981
font_01_sfnt_off00010112.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10112 10820 bytes
SHA-256: 33f6ca944abb07ba3c030bc7d0f1758132b612edc04f7969b97432baf604f93d
font_02_sfnt_off000125b5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x125B5 4324 bytes
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3

Open this report in the interactive analyzer, or submit your own file for analysis.