Malicious PDF — malware analysis report

Static analysis result for SHA-256 c950b50668f98ffa…

MALICIOUS

PDF

79.4 KB Created: 2021-06-29 00:43:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: ecfb22559c398f0b7a8e384432c3366e SHA-1: b13993497e6db417e1fa96be0065a7a3437f0ff6 SHA-256: c950b50668f98ffa22d8854dae602932b68c006f9cdf234b5f9162e116aa813c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The PDF contains embedded URLs, one of which points to a suspicious domain, suggesting a phishing or malware distribution attempt. No scripts were extracted, but the presence of embedded URLs and the overall detection score strongly suggest a phishing attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9846

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://betenenergy.com/sites/default/files/file/58243823847.pdf
    • https://webtraffic.ch/wp-content/plugins/super-forms/uploads/php/files/2od447voek6noas9813beb6j4l/nijewiwogukoferidi.pdf
    • https://www.temsilcisitesi.com/wp-content/plugins/formcraft/file-upload/server/content/files/16072a9ad90886---todewifera.pdf
    • https://noukos.gr/wp-content/plugins/formcraft/file-upload/server/content/files/160732ab90c1e5---tawogamoxupuxipedi.pdf
    • http://quickfix-poland.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609f16430db43---60832189433.pdf
    • https://bcbc3399.com/upload/files/gewozuta.pdf
    • http://animalscipublisher.com/files/upfiles/file/wikovaxinatiz.pdf
    • http://triumphtoday.org/wp-content/plugins/formcraft/file-upload/server/content/files/160c548fbc0ecb---denufid.pdf
    • https://sonntag-immobilien.lu/userfiles/files/vitulafagonomitesibaz.pdf
    • http://bellina.pl/userfiles/file/wejijixuvu.pdf
    • https://reitinguok.lt/userfiles/file/wajujaxibutuk.pdf
    • https://www.hotwaterfactory.com.au/wp-content/plugins/super-forms/uploads/php/files/13cc9c14184d856c8f6d37a809490ccd/72846911017.pdf
    • https://www.mercedesbenzofaustinservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a3e6d083b7f---7077370550.pdf
    • https://wpsqld.com.au/wp-content/plugins/super-forms/uploads/php/files/d81881e6c418112d1e2966a8b66343b3/mosirupijeke.pdf
    • https://completecollegestrategies.com/wp-content/plugins/super-forms/uploads/php/files/4acb6b417c7c03e1043f0bc1cfb1b86c/mozilebofe.pdf
    • http://alarcon-v.com/editor_upload_image/file/34063224450.pdf
    • http://martonaroniskola.net/userfiles/file/najamotatepo.pdf
    • https://www.hediyevideo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a766c2de8a7---megulifumenozulik.pdf
    • http://www.x454.com/wp-content/plugins/super-forms/uploads/php/files/16ghmq83nvahkrknfh0hd1amt0/22542055489.pdf
    • http://opalbiosciences.com/wp-content/plugins/formcraft/file-upload/server/content/files/160917cadb76a7---22645848129.pdf
    • https://investainternational.com/wp-content/plugins/formcraft/file-upload/server/content/files/16098c1532aa97---xakepenuxil.pdf
    • https://www.hospedeagora.com.br/wp-content/plugins/super-forms/uploads/php/files/fkme44ph6rmg4fcigb5rtk4969/29619415319.pdf
    • http://bdn10.cz/files/file/96651381559.pdf
    • https://polskieplytki.com/wp-content/plugins/super-forms/uploads/php/files/f4cf80d579285efdab9091c286dad104/48784376678.pdf
    • https://namratalakhotia.com/userfiles/files/gibobugukurinixefatuv.pdf
    • http://brandweeramsterdamamstellanden.nl/userfiles/file/biranotorumapufa.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/BvfzZFkJO3s/uplcv?utm_term=play+piano+on+laptop
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d80c.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD80C 16792 bytes
font_01_sfnt_off0000f01e.bin
d5b7886a5208c571b68f74eab3732dabcadc95a17466455d33fdfdbca5b3db0c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF01E 16300 bytes
font_02_sfnt_off00011a32.bin
ece03423c4949ef9e37278749f522e0679255c8c146a79b53ec8c08d04161017		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11A32 9960 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.