Malicious PDF — malware analysis report

Static analysis result for SHA-256 c662bc617d73e1f1…

MALICIOUS

PDF

90.1 KB Created: 2021-05-06 22:12:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: c1a0bef6663f4677012d607afa4fb3df SHA-1: 81d8269aba3dbd5a6a139d0ea8ea1cce42c84c2f SHA-256: c662bc617d73e1f16decbcc33260fd3afcaf2332d126ab587ceff88c8d000400
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=why+did+britain+build+an+empire PDF link annotation
    • https://cdn.sqhk.co/jidobimatu/idjStja/wirujakikugino.pdfIn PDF document text
    • https://cdn.sqhk.co/vikojovowoso/ihdgi8c/crosswords_with_friends_answers_6_12_18.pdfIn PDF document text
    • https://cdn.sqhk.co/mukujoripu/xMgiygd/blocky_roads_apk_full.pdfIn PDF document text
    • http://carins.info/honeywell_rpls730b_ground_wire10r6g.pdfIn PDF document text
    • https://cdn.sqhk.co/sadetujadufi/rljaohd/45496593415.pdfIn PDF document text
    • http://remastacer.com/wojibopamulekezetmr8yx.pdfIn PDF document text
    • https://cdn.sqhk.co/fekolisuzub/dQbiiic/50618517162.pdfIn PDF document text
    • https://cdn.sqhk.co/bepeguvovori/AWvojgZ/lukalukagiruzokaderarejil.pdfIn PDF document text
    • https://cdn.sqhk.co/mofijovelu/hd9heig/hide_n_seek.pdfIn PDF document text
    • http://shop-kid-toys.online/nipeketupa0ui1z.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jodabiladezot/carbonate_de_sodium_formule_brute.pdfIn PDF document text
    • https://s3.amazonaws.com/tonemakopinibem/dd_warforged_race_stats.pdfIn PDF document text
    • https://s3.amazonaws.com/xuvamuba/what_is_composition_in_english.pdfIn PDF document text
    • https://s3.amazonaws.com/gapuruxumeg/71741881069.pdfIn PDF document text
    • https://s3.amazonaws.com/lakujusitejojet/19035602671.pdfIn PDF document text
    • https://s3.amazonaws.com/legesiliv/inverse_functions_identifying_pairs_worksheet_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/pazatuv/phonetic_alphabet_police.pdfIn PDF document text
    • https://s3.amazonaws.com/norozovijalu/guess_the_horror_movie_picture_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/vokeri/arya_movie_songs_malayalam.pdfIn PDF document text
    • https://s3.amazonaws.com/tisegovofu/supobakamekod.pdfIn PDF document text
    • https://s3.amazonaws.com/laginekux/jest_coverage_report_path.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000104dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x104DC 5276 bytes
SHA-256: 3e7a76a62612bb2128b0e9e20c4d8aa225af931c4bbd07395e9bcf9d5ff0c68d
font_01_sfnt_off000116a5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x116A5 1936 bytes
SHA-256: 84daf345e21b08075a6e329eeacb0a13a0447ddcc3efc64e98a9a4ab9c6a9d9d
font_02_sfnt_off00011fe6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11FE6 10764 bytes
SHA-256: fe6bd6630fb0cd8321158152375cd377c1f085c1c8605dc8ae89c91bec8af8ea
font_03_sfnt_off000144bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x144BB 16352 bytes
SHA-256: a235935b7da1a3e0dfb4386fa22d70075346861adeac55da3f8f322ddd140fe5

Open this report in the interactive analyzer, or submit your own file for analysis.