Malicious PDF — malware analysis report

Static analysis result for SHA-256 c9518796a21d3eb5…

MALICIOUS

PDF

74.8 KB Created: 2021-04-07 20:58:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0ba8c8e479ba3b4779bfcacbcc2ca7bc SHA-1: af75e062d49467cd65fd5525f1040502d7e43723 SHA-256: c9518796a21d3eb5be0cabb628243a58e3c94595dd800f7aaa286c813844d72b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that points to a suspicious domain, likely for phishing purposes. ClamAV and ML classifiers also flagged this PDF as malicious. The presence of embedded URLs and the overall malicious classification strongly suggest a phishing attack vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/wix?keyword=periodic+trends+test+review+worksheet
    • http://wamipivifubape.sportsontheweb.net/46691008583.pdf
    • http://mufosubofamar.mywebcommunity.org/athens_sightseeing_map.pdf
    • http://neridofufuleteg.scienceontheweb.net/food_and_beverage_cost_control_6th_edition.pdf
    • http://buzatukati.iblogger.org/arabic_alphabet_with_pronunciation.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/24a516f1-c31d-4992-9716-a89cee038fa9/72127843487.pdf
    • https://s3.amazonaws.com/nezanurugega/honeywell_portable_evaporative_air_cooler_manual.pdf
    • http://pexuxiwug.rf.gd/9880089279.pdf
    • https://s3.amazonaws.com/pukiza/bikini_body_pre_training_guide.pdf
    • https://uploads.strikinglycdn.com/files/a0baf2fe-cc41-47ad-8923-aafa560f23ec/how_to_do_call_forwarding_on_landline.pdf
    • https://uploads.strikinglycdn.com/files/645bf5e7-12d9-4044-b542-a09879a370fd/sagapebuv.pdf
    • http://niwirafe.rf.gd/gojililusur.pdf
    • http://jomewudixaf.epizy.com/giwizipapotuzivali.pdf
    • https://uploads.strikinglycdn.com/files/0cfc48f7-928b-4f1e-9396-1469d03c64ce/power_wheels_cadillac_escalade_battery.pdf
    • http://nafezot.epizy.com/fibesuzenel.pdf
    • https://07e0a16e-b77d-475b-b724-88bbaedb347c.filesusr.com/ugd/8e9e2f_10d0309438314844856989c83f034ec3.pdf?index=true
    • http://rifazos.rf.gd/xuvuwetubomes.pdf
    • https://9301df3d-c689-496c-811c-0581e5fecd74.filesusr.com/ugd/f62067_c3c474203455401b969a6b75542ccdd8.pdf?index=true
    • http://kikasipab.epizy.com/tanarareguwamuf.pdf
    • http://dutugege.epizy.com/best_spreadsheet_software_for_windows_10.pdf
    • https://36c7e617-1221-4173-b726-d5bce2878801.filesusr.com/ugd/610d21_7ef388d4225e40bfad018faefea38cc6.pdf?index=true
    • https://da89e6ec-52f9-4c28-8de8-447a2e923c0c.filesusr.com/ugd/5e5b2a_c6cc4dc322a34e1cb956ea7444f6a8d2.pdf?index=true
    • http://valopuloti.rf.gd/gy6_150cc_engine_horsepower.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e907.bin
2e1f954c5dc2a9783105d6f96a621989476fe6d7545021e69c431da640599e03		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE907 5004 bytes
font_01_sfnt_off0000fa1d.bin
b0bb8c38506084c2c5f9a3d3a9d1e7410470ee324c48ad023ad89ad8314694b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA1D 10492 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.