Malicious PDF — malware analysis report

Static analysis result for SHA-256 c84ffc5c41bad810…

MALICIOUS

PDF

84.2 KB Created: 2021-02-26 05:12:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12
MD5: 410ea45bdacc106bef288eaf9b85cb44 SHA-1: 76c639c603c6d5dc838080a4049985d2256baf82 SHA-256: c84ffc5c41bad810c2d06cedc7ec69d9d8ae0fa1962ea1cb2e6980b9503b777c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that redirects to a suspicious domain, likely intended for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent. Although no scripts were extracted, the presence of external URIs and the document's structure suggest it's designed to trick users into visiting malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/award?keyword=annie+john+chapter+7+summary PDF link annotation
    • http://lesagotefawa.22web.org/nizamoled.pdfIn PDF document text
    • http://tonalemeketav.66ghz.com/dbt_therapy_techniques_for_anxiety.pdfIn PDF document text
    • http://pefiworawodud.mypressonline.com/programmable_logic_controller_free_download.pdfIn PDF document text
    • http://wabuxon.iblogger.org/balasore_alloys_limited_annual_report.pdfIn PDF document text
    • http://navevukosuso.mypressonline.com/74636796328.pdfIn PDF document text
    • http://lojapidabud.mypressonline.com/age_appropriate_games_for_8_year_olds.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/dinilederu/jungers_kerosene_heater_manual.pdfIn PDF document text
    • http://fafuwite.epizy.com/b._a._n._k_full_form.pdfIn PDF document text
    • https://s3.amazonaws.com/vobuturinivi/1046800408.pdfIn PDF document text
    • https://s3.amazonaws.com/wixatax/1st_year_economics_question_paper_with_answer.pdfIn PDF document text
    • https://s3.amazonaws.com/wutisigila/bupodizutapisasakovi.pdfIn PDF document text
    • http://napalujimawoz.rf.gd/english_grammar_multiple_choice_questions_with_answers.pdfIn PDF document text
    • http://dipijiz.epizy.com/17608047612.pdfIn PDF document text
    • https://s3.amazonaws.com/tomaxade/pukotiserodiba.pdfIn PDF document text
    • http://vopevufiwi.epizy.com/inferential_statistics_worksheet.pdfIn PDF document text
    • http://jonapepubenej.epizy.com/protobelt_katarina_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/silubebebefuju/buvirenebusage.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010051.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10051 5268 bytes
SHA-256: 840ceef1bf21e41ab470274535f6791504b74427c10d2cfcb47ea981af386e07
font_01_sfnt_off00011215.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11215 10332 bytes
SHA-256: 834a0e0abe2ad470dc907e2f3f21dace689fb341c30142ea1ecf0b3fa9a8866b
font_02_sfnt_off00013561.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13561 4324 bytes
SHA-256: 9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2

Open this report in the interactive analyzer, or submit your own file for analysis.