Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca27402e7c366819…

MALICIOUS

PDF

229.7 KB Created: 2022-05-27 04:44:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2022-07-15
MD5: 96656e1ce1aec8adc609e177e03e7bc0 SHA-1: f4a71479fe55047e79459b81dea0c951ddb8f6b9 SHA-256: ca27402e7c366819f8292aff1366fb2fc6d878e6c71f53e78c1ac2a7e7810135
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The file was identified as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains an embedded URI pointing to a suspicious domain, likely intended to lure the user into a phishing or malware download site. The presence of multiple unknown URLs further supports the phishing pretext.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6593

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://loheb.co.za/XSRYdR1H?utm_term=copy+text+from+pdf+to+word+without+line+breaks+free+online+free+printable
    • http://cidadania23pr.org.br/ckeditor/kcfinder/upload/files/94987327444.pdf
    • https://bewulikafujisew.weebly.com/uploads/1/3/5/3/135326730/7280648.pdf
    • http://volareinmongolfiera.it/userfiles/files/65474173485.pdf
    • http://musik-fachberatung-neumarkt.de/images/uploadedimages/file/tezelusipagavowimawosoda.pdf
    • http://babika.cz/data/files/nefifamozepudifaxifa.pdf
    • https://furedgym.webtarhely.org/webroot/upload/files/dudoran.pdf
    • https://zofitete.weebly.com/uploads/1/3/2/7/132740948/7259100.pdf
    • http://vertex-decor.com/userfiles/file/rusur.pdf
    • https://defi128.phpascal.com/userfiles/files/nadejelafidoxesuno.pdf
    • http://lngpetro.com/userfiles/file/11342889292.pdf
    • https://kajivuzixoji.weebly.com/uploads/1/3/4/3/134332867/juremef-losenivetoneki.pdf
    • http://www.peritaonline.es/ckfinder/userfiles/files/85120758292.pdf
    • https://apexforestservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/162282588048a5---gexosalasofidemipe.pdf
    • https://bisleriuber.genefied.co/ckfinder/userfiles/files/puxavititalokobo.pdf
    • https://mufepubawitig.weebly.com/uploads/1/3/4/6/134614790/8343354.pdf
    • http://www.deopendeur.org/imgUser/file/96251746074.pdf
    • http://studiomilano.eu/userfiles/files/vonininogabuwujugurenujaj.pdf
    • http://astorandblack.net/emailer/userfiles/file/wuwuwokofepidiz.pdf
    • http://www.cenlaenvironmental.com/siteuploads/editorimg/file/36867014340.pdf
    • https://gadikara.weebly.com/uploads/1/4/1/2/141256258/0176a355d6a.pdf
    • https://apskarota.org/userfiles/file/powemiso.pdf
    • https://tekebuzegox.weebly.com/uploads/1/3/0/8/130814382/894e841.pdf
    • https://nergizleryapi.com/image/files/22242369410.pdf
    • http://jd6618.com/jd6618/file/2022-2/file/LwpCms2022_02_19_10_57_08_1465.pdf
    • http://cameronhaddock.com/wp-content/plugins/formcraft/file-upload/server/content/files/16206f7075257f---filonuronakozudinox.pdf
    • https://brincandoeaprendendo.com/fotosempresa/files/jiroruwenanoxeravelobe.pdf
    • http://emannsltd.com/userfiles/kumizakapefuvirixuti.pdf
    • http://surtek.biz/image/files/20151125_002231.pdf
    • https://kafakekamiv.weebly.com/uploads/1/3/4/6/134646951/ruzuxeda.pdf
    • https://bentonhomebuilders.com/kcfinder/nutepesodoxefakopex.pdf
    • http://makesomenoise.hu/upload/file/27327505811.pdf
    • https://dverimilana.ru/media-temp/img/uploads/files/93848631971.pdf
    • https://www.numberoneporthill.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/16212045731b51---48590658618.pdf
    • http://immat.org.tr/kcfinder/upload/files/fapemutipiletorifovedupig.pdf
    • https://powiedzdoktorze.pl/file/files/87839328130.pdf
    • http://isiknakliyatmasko.com/img/editor/image/file/gufefufawunimu.pdf
    • http://adgroup.co/userfiles/file/pekolupa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000325b4.bin
68c4b3ed81575b238d86c9332a2b1e78ce35e759f18f8e70ea90173bd68674f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x325B4 17380 bytes
font_01_sfnt_off00035333.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x35333 16792 bytes
font_02_sfnt_off00036b4a.bin
88d0e3cbb9b26da9c2d5bdcb5510fe08f25c3f711c7352e263dbbba566baef3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x36B4A 11428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.