Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca50adaf72b3bbd5…

MALICIOUS

PDF

80.8 KB Created: 2021-02-24 02:40:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 6cbded4b2951992d4a76abc6992ef67d SHA-1: e87e113d940cad1b25cc85230f954ec8d4d163c0 SHA-256: ca50adaf72b3bbd5bd3d3d71322c1c98bf943c0fdc1a3c550b5e2c4fb3b1ef80
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that is likely used for phishing or to download a secondary payload. The ML classifier and ClamAV detection strongly indicate malicious intent, with the PDF_URI heuristic pointing to a specific URL used in the attack. No scripts were extracted, but the overall structure and heuristics suggest a malicious document designed to trick users into clicking a link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/strik?utm_term=hp+elitebook+2760p+ssd+upgrade PDF link annotation
    • https://cdn.sqhk.co/jegamaxegev/jrEhhOM/retrovirus_vs_virus.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4471512/normal_60034447cc8b0.pdfIn PDF document text
    • http://rawenspant.online/stephen_king_thinner_book_reviewgyfoe.pdfIn PDF document text
    • https://waboralitenir.weebly.com/uploads/1/3/4/5/134504299/5c828c5245c85.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408865/normal_6035873e574c6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412778/normal_601b5563f10cc.pdfIn PDF document text
    • https://buxexemap.weebly.com/uploads/1/3/4/8/134890763/3420506.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4485942/normal_5feb00f32068b.pdfIn PDF document text
    • https://cdn.sqhk.co/xuxodokoju/zKoQtgi/dark_souls_3_all_braille_divine_tomes.pdfIn PDF document text
    • https://cdn.sqhk.co/litanamamusi/egediaR/facebook_business_manager_account.pdfIn PDF document text
    • https://gogesixemaso.weebly.com/uploads/1/3/2/3/132302802/jilibajidapive.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4452217/normal_5fca0b0eb7998.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/wezukep/strength_and_conditioning_training_for_weight_loss.pdfIn PDF document text
    • https://s3.amazonaws.com/fapaga/mogibi.pdfIn PDF document text
    • https://s3.amazonaws.com/voropa/79953493730.pdfIn PDF document text
    • https://s3.amazonaws.com/niporofez/febuno.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e582.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE582 5800 bytes
SHA-256: ffad8351df48126cf869ffff8c16053e6ada52941c0f00ca842a6a1818d9aa2d
font_01_sfnt_off0000f94a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF94A 11428 bytes
SHA-256: 1ab9433c979d32778d4d6cc23abdd82126c55830d18365cf1d62d4792ab1bcdf
font_02_sfnt_off00012063.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12063 16240 bytes
SHA-256: bdd59c7b5d22a769ca977c6605be0e660b04ff00fee5d239d3b3f83c05660c5d

Open this report in the interactive analyzer, or submit your own file for analysis.