Malicious PDF — malware analysis report

Static analysis result for SHA-256 c9a33733ecfc7f5e…

MALICIOUS

PDF

160.3 KB Created: 2021-03-22 08:04:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3cef00abc468e1c2fc0509ae95cb5a30 SHA-1: 118a54b82252d782f7e07919f64d4f85d5267372 SHA-256: c9a33733ecfc7f5e5629859f021d693ed71fd3dc01161e93c1758b0e72d2d8ba
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that redirects to a suspicious domain, suggesting a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URI heuristic point towards a social engineering attack designed to trick users into visiting a malicious website.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=vishnu+sahasranamam+in+kannada+pdf+on+pooja
    • https://cdn.sqhk.co/tomubozes/uggijUa/dead_age_wikia.pdf
    • https://cdn.sqhk.co/valujoper/btji7VW/16989916199.pdf
    • http://jojujikipafoz.iblogger.org/coast_electric_report_power_outage.pdf
    • https://cdn.sqhk.co/tugirujozi/ulyhdH6/bike_ride_tracker_apple_watch.pdf
    • http://fedorahosted.org/lohit
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://9e084d23-5bbf-42ad-98e9-fa9200f8584e.filesusr.com/ugd/4f663b_27c9efa627504fefa6680caa92f74c53.pdf?index=true
    • https://d4e73f68-9870-4c81-be0c-0a6dd7607cd2.filesusr.com/ugd/6f53d7_58fdba43b14640abb47e46b28f40cf0d.pdf?index=true
    • https://s3.amazonaws.com/faduxodiwo/garageband_to_mp3_converter_iphone.pdf
    • https://4bc473c2-84d0-4913-8b4e-281bf44fba2e.filesusr.com/ugd/a25dbd_5787f128d49840b1b5fe3fbe1d64bc5c.pdf?index=true
    • https://2cc12256-1025-444a-bacb-901a9f007bda.filesusr.com/ugd/d1fcfc_1afcb084942843009491fdc84d4da206.pdf?index=true
    • http://pugonekiwijotom.rf.gd/movaket.pdf
    • https://f72b89be-0fa6-41ee-8162-331329ef78ce.filesusr.com/ugd/95089d_a3353a5fa8d247bca1de2ec933b2e8f7.pdf?index=true
    • https://s3.amazonaws.com/wifiduxezo/tecnologia_de_informao_na_logistica.pdf
    • https://s3.amazonaws.com/zoxewudunigus/99438543261.pdf
    • https://s3.amazonaws.com/xeponodij/traduccion_de_espaol_a_ingles_pronunciacion.pdf
    • https://d75bbb92-b0e4-4b50-83e6-2443e695523b.filesusr.com/ugd/bc73b9_02794210fd7f4229babb75eb29209f64.pdf?index=true
    • https://s3.amazonaws.com/biwuwukesazef/67101778561.pdf
    • https://s3.amazonaws.com/kakef/civetta_critical_care.pdf
    • https://s3.amazonaws.com/zosevid/50975617295.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNU
    • http://www.gnu.org/copyleft/gpl.htmRegular
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0001d6b1.bin
7cbacd0b3394bb33e7617908b031e01e7d95d4be4f2a3d160820ea7ba1306cde		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1D6B1 64892 bytes
font_00_sfnt_off0001b8fe.bin
627befbb490a9dd6a777a6a31b76c90372393c6769955949ec56c055fb030576		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1B8FE 5356 bytes
font_01_sfnt_off0001cb0d.bin
4cd60777e265fafd80a6c4ac8a8f541642313e2b1c6670a3899fdf55b12f51bc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1CB0D 3772 bytes
font_03_sfnt_off00023792.bin
0b286a2afac678572f0c1d983d08b570e210e0c9d7b36f0b3de6185e933fddc9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x23792 10444 bytes
font_04_sfnt_off00025abb.bin
7f268005b80ff82e89639affb95403f55eddb42516abbde6a76e27226db124cd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x25ABB 16172 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.