Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca6e9a2f35751eda…

MALICIOUS

PDF

89.6 KB Created: 2021-05-08 16:08:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6cedf93c1263103a4eb4f7d89c817f04 SHA-1: e77469b1722632cd35c829ac711d51a2be0692cc SHA-256: ca6e9a2f35751edac6085e0ec024f87e775aac21ce1b448d0d6c79ee2426f987
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic firing for an external URI pointing to a suspicious domain, and ClamAV detection confirms its malicious nature. The embedded URL suggests a phishing or malware distribution attempt, likely disguised as a search result to trick the user into visiting the malicious site. No scripts were extracted, but the presence of external URIs and the ML classifier's high confidence indicate a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=princess+diaries+2+chinese+song
    • http://afracheat8.xyz/business_portrait_photographers_near_me6cckc.pdf
    • https://cdn-cms.f-static.net/uploads/4411220/normal_60366b200b9ef.pdf
    • http://pasendapp.online/benediktas_gylys_bitonomijad9gcx.pdf
    • http://wssummer.space/667174759561yn81.pdf
    • http://sedouche.xyz/cartas_de_san_pablo9wl4a.pdf
    • https://static.s123-cdn-static.com/uploads/4478438/normal_600923c9f2677.pdf
    • https://cdn-cms.f-static.net/uploads/4381997/normal_604974e85a1bd.pdf
    • https://cdn-cms.f-static.net/uploads/4365600/normal_603b9185568ac.pdf
    • https://cdn-cms.f-static.net/uploads/4443624/normal_5fe7bc83274b7.pdf
    • https://static.s123-cdn-static.com/uploads/4388163/normal_5ffac11498abb.pdf
    • http://gordei2d.com/crystaldecisions._crystalreports._engine._dll_11._5dho77.pdf
    • https://static.s123-cdn-static.com/uploads/4367312/normal_600934ce078c9.pdf
    • http://zunuruxeguxifi.mygamesonline.org/blood_relation_for_ibps_clerk.pdf
    • https://cdn-cms.f-static.net/uploads/4417141/normal_6054a971b16b5.pdf
    • https://cdn-cms.f-static.net/uploads/4485322/normal_601c6ae0e7e39.pdf
    • http://zonojebiridizo.mywebcommunity.org/42277024128.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/dazinibonofobi/how_to_play_record_player_through_soundbar.pdf
    • https://s3.amazonaws.com/midipes/assassin_s_creed_3_apk_data_obb.pdf
    • https://s3.amazonaws.com/zomuzigo/english_b_hl_guide.pdf
    • http://tuparibuju.atwebpages.com/oxford_picture_dictionary_free.pdf
    • https://s3.amazonaws.com/belopudevuzuza/xidowapaterurozi.pdf
    • http://zasuwunal.myartsonline.com/boogie_oogie_oogie_sheet_music.pdf
    • https://s3.amazonaws.com/tujeviwakirawu/norton_antivirus_mobile_full_apk.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010003.bin
462590f4548b1144a9e2324d19634f64fa02b91fa74db834f7345659b1aaa39e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10003 9968 bytes
font_01_sfnt_off000120f6.bin
d5f9e9aa34056c9b0326ecbda182ad045dda0348ddc21a2210b4054c0b02b730		 pdf-font-stream PDF embedded font (sfnt) at offset 0x120F6 5304 bytes
font_02_sfnt_off000132fa.bin
29a9cd9174108fba30946f4d5590ef29970fafbbb179b8a8310b644fed609fec		 pdf-font-stream PDF embedded font (sfnt) at offset 0x132FA 11144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.