Malicious PDF — malware analysis report

Static analysis result for SHA-256 c8150315fee46b79…

MALICIOUS

PDF

75.1 KB Created: 2021-03-15 21:00:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 87106ba28c5e06f19a226f0ce21a2d81 SHA-1: b915ed5c379641106805440a516b577ccec3a9fd SHA-256: c8150315fee46b79aa3c05df619897ac732626d9869e722f27594b891b1941a6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that leads to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also strongly flagged this PDF as malicious. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, suggesting it was generated programmatically to appear as a document, likely to facilitate a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/award?keyword=biomagnetismo+goiz+680+pares+pdf
    • https://cdn.sqhk.co/moxinivo/ja2CihV/60125682741.pdf
    • https://cdn.sqhk.co/bovutolomevo/jhYgehd/redcon1_mre_lite_5_lb.pdf
    • http://prizinsta365.website/patimuzepogeg2gwxu.pdf
    • http://changely.club/white_rodgers_thermostat_display_light_not_workingpq179.pdf
    • http://philonio.online/formal_lab_report_example_physicslxr2h.pdf
    • http://krepezh.guru/bushnell_neo_ion_quick_start_guide92sr0.pdf
    • http://sethel.xyz/how_to_clean_lasko_tower_fan_25598yglq.pdf
    • http://barcaporirternet-interbank-pe.com/golf_buddy_voice_x9x8w6.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://e97408dc-4b05-4e3b-9f19-f4127feb49ef.filesusr.com/ugd/a42eed_18d13484d06341d09bbf9732a33a7bba.pdf?index=true
    • https://uploads.strikinglycdn.com/files/62a6681b-2ff5-4413-a832-243f6fceb18a/ruger_lcp_2_laser_light_combo.pdf
    • https://656adf98-7a81-40bd-8d0f-2b9c27d09201.filesusr.com/ugd/268ab1_69fba9555a984a088814157bba43bb33.pdf?index=true
    • https://874c0fd6-92eb-497b-905f-dc7ca4d2e287.filesusr.com/ugd/5ca7d4_987fe90c09ae435da3c1d963ae2e2bdf.pdf?index=true
    • https://uploads.strikinglycdn.com/files/4af34d43-559c-4c82-8712-b6ff0bb362a3/13850901462.pdf
    • https://uploads.strikinglycdn.com/files/0ad15ecb-4a13-4c13-a954-4624880eb96a/paxinivomijizux.pdf
    • https://03386fec-e341-46be-bf9f-2f2bd19f9bfe.filesusr.com/ugd/bf57b5_af67007ee2a242adace505145d0c25cd.pdf?index=true
    • https://f608bf75-187c-4b28-9621-af925c05c2b6.filesusr.com/ugd/05e3ad_fbe3bb7572b74ec791952164fd7a9d58.pdf?index=true
    • https://0c6b7a74-1ca0-41da-943c-c268a208a416.filesusr.com/ugd/fef373_242db1ab9acf424ab5e26ced3da88f3c.pdf?index=true
    • https://e1318bff-d970-45e2-bcea-45481503a18b.filesusr.com/ugd/75a96d_45a2cd3e18c94e358438896997340080.pdf?index=true
    • https://13adc596-845f-4f4a-b539-e2c04a0a4b5a.filesusr.com/ugd/6e2da7_3cdb4ccea3ca483f967bc7abb8f926b2.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3f1ba4d9-f514-434e-bc71-86b3a2de8ec5/watefovono.pdf
    • https://c3e780e1-a1ee-422e-80b3-2bf79490ff1e.filesusr.com/ugd/dc7b26_9bcd208b2ed34d4e97069002e0c458d5.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d63c.bin
00692e809a479b8034ed4e9343ef74992b57ce034b7faa70ea3a3c7d3cba7211		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD63C 5920 bytes
font_01_sfnt_off0000ea49.bin
f44567dd77a4efe0a73930bcb403fca67588c8888291668dde79f96a9b17a721		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA49 2356 bytes
font_02_sfnt_off0000f471.bin
71fdf4aea7b65fcde58d3513fb90f18e5214e788b420b75d6a8445916652e0ae		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF471 12392 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.