Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca84e807bbbd287a…

MALICIOUS

PDF

80.8 KB Created: 2021-03-26 17:48:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: 6ec02dad32e2d570623d9df6a0a6b12f SHA-1: a6c309cb748ec0feecc11b3f517987db6cf154a1 SHA-256: ca84e807bbbd287ae81c79dc97f77b70025da0c890c9e4b6b68e25bd99c7d216
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that appears to be a lure for downloading content, disguised as a free PDF. The document body, though heavily obfuscated, contains text related to free downloads and the authoring application, suggesting a deceptive purpose.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=free+download+amar+chitra+katha+in+hindi+pdf PDF link annotation
    • http://votofeveta.iblogger.org/line_6_spider_valve_mk2_head.pdfIn PDF document text
    • http://babubusawase.22web.org/veripixop.pdfIn PDF document text
    • http://lixuninipakimar.iblogger.org/38488429332.pdfIn PDF document text
    • http://kawolamekepe.22web.org/birimobugazejafovomoj.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369659/normal_6035f18092017.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4482870/normal_5fca0adb421c9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4456676/normal_6017ad860c372.pdfIn PDF document text
    • http://fefikaniki.22web.org/48963726498.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://dibesenowox.epizy.com/hp_officejet_pro_8600_will_not_turn_on.pdfIn PDF document text
    • https://s3.amazonaws.com/rimepusox/real_estate_market_definition.pdfIn PDF document text
    • http://popadugabi.rf.gd/wrong_turn_movie_online.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/be8c34fb-c4a6-49a9-91e2-88575254210b/vigikosotoguve.pdfIn PDF document text
    • https://s3.amazonaws.com/sezewu/arroba_definicion_informatica.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1c3c671e-229e-442b-83e5-125b23f36ec4/james_patterson_books_2019.pdfIn PDF document text
    • https://899154e9-876a-4ab4-94d5-c8ef2aed10f2.filesusr.com/ugd/dcf9ad_7c6e91a8569b4ad3b8264d054f9ef8f0.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/e25d1faf-a8e1-46fb-a6d7-56ac196a6f84/62841053792.pdfIn PDF document text
    • http://bidavavaxekize.epizy.com/podidi.pdfIn PDF document text
    • https://7afd96e6-4611-46d4-9b98-d111b897c281.filesusr.com/ugd/154221_72bc634f1c2b4c3cbc68e5f9e4279d49.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zufaxepixiguxax/circular_motion_and_centripetal_force_worksheet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5161359d-e178-471d-9065-ad705f68209e/4670699678.pdfIn PDF document text
    • https://883cd1dc-02d0-4059-8fa2-99201f92b631.filesusr.com/ugd/6166c9_178a0cb31a1a4687a61895afd870ef77.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wurivuve/94882386563.pdfIn PDF document text
    • https://s3.amazonaws.com/juwofuxufijup/7415269690.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eee1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEEE1 3312 bytes
SHA-256: ac66ddecb1889e99694234647e4a1e19b6174440e696c9ee44c6cb9711419273
font_01_sfnt_off0000fac2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFAC2 5328 bytes
SHA-256: 9ab8e43246f0096acf59ccaf94c67a87061cc97e6e05377a69249b755dcd495b
font_02_sfnt_off00010cce.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10CCE 12004 bytes
SHA-256: 13cb610288cb8f6bb27e84a68ff2aee311b2f5f14064a251c11c12a3fb1feb8a

Open this report in the interactive analyzer, or submit your own file for analysis.