Malicious PDF — malware analysis report

Static analysis result for SHA-256 c63981dfec9f28a1…

MALICIOUS

PDF

67.1 KB Created: 2021-03-23 17:30:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fe768ecb2cfd90176a915bd656fcbd77 SHA-1: 579bc1cf7b864fa89c6274bffe660bbfa5826749 SHA-256: c63981dfec9f28a10b2c55049d6dfc6df6404a67305c231395c2c9812799280e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that points to a suspicious domain, identified as a potential phishing or malware distribution lure. The document body, though heavily obfuscated, contains text related to 'simple scone recipe pdf' and is associated with a high-risk score and ClamAV detection for 'Pdf.Phishing.Trojan'. This suggests the file is designed to trick users into visiting a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/award?keyword=simple+scone+recipe+pdf
    • https://cdn.sqhk.co/podidiwi/B2hgiWy/kizesupajerubef.pdf
    • http://pidawudimo.scienceontheweb.net/4771276794.pdf
    • http://naliputa.mywebcommunity.org/problem_statement_thesis.pdf
    • https://cdn.sqhk.co/gijimexuv/5jghiIC/coffin_dance_piano_version_ringtone_download.pdf
    • http://sokobumoxagug.scienceontheweb.net/advantages_and_disadvantages_of_computer_technology_in_education.pdf
    • https://cdn-cms.f-static.net/uploads/4416791/normal_6014dd23254da.pdf
    • https://static.s123-cdn-static.com/uploads/4465007/normal_6006ffb8a32e6.pdf
    • http://misujupino.getenjoyment.net/83816648964.pdf
    • https://cdn.sqhk.co/fasaparoba/dnBkZia/get_followers_and_like_instagram_apk.pdf
    • http://mujudesuxiropa.sportsontheweb.net/blackberry_classic_non-camera_black_16gb_verizon_wireless.pdf
    • https://static.s123-cdn-static.com/uploads/4373016/normal_5fcdac6c47d9d.pdf
    • http://nemugub.mywebcommunity.org/vigiguwosaf.pdf
    • https://cdn.sqhk.co/bimeniwog/dygevpa/download_lost_miner_premium_apk.pdf
    • http://mejumeroxara.mywebcommunity.org/phases_of_drug_metabolism.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/tadevewuju/45004226901.pdf
    • https://uploads.strikinglycdn.com/files/f201c381-630e-4dfd-aafb-738ec3d8a3f5/levezasimololuwanopopo.pdf
    • https://uploads.strikinglycdn.com/files/48810c16-7388-4aa1-a8ad-413039bf2223/ge_profile_microwave_oven_light_bulb_replacement.pdf
    • https://uploads.strikinglycdn.com/files/acf18745-dad7-4a43-8f5f-5e0461c62395/distinguish_between_voiced_and_voiceless_sounds_with_adequate_examples.pdf
    • https://s3.amazonaws.com/lopadivupudexa/ue_boom_app_free_iphone.pdf
    • https://uploads.strikinglycdn.com/files/28b42fb3-44fb-4a36-823a-7631f45f762b/zawel.pdf
    • https://s3.amazonaws.com/marimejerebo/40781453539.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cbc5.bin
9969d59a8731caed6c9ab2525682d81ce11b9f5934dbbabb94ed8da9534e81a5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCBC5 5196 bytes
font_01_sfnt_off0000dd5a.bin
e80c7642f8396901cfc32eb00b90460c556f3f4b864d7fe3aafbab34b8785e6f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDD5A 9988 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.