Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb251d12095befd3…

MALICIOUS

PDF

431.2 KB Created: 2022-05-29 03:44:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2022-07-15
MD5: 03e06f3ac28ac2d1c587d8908a8fd970 SHA-1: d3b1b9faf2c1de84285bfa75361f5f867e98feb9 SHA-256: cb251d12095befd3fcdb559552d028133a9f9cb5794dd1585f71a491c0985dfd
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains an embedded URL that redirects to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. This suggests the document is designed to trick users into visiting a malicious site, likely for phishing purposes. The presence of multiple unknown and potentially malicious URLs further supports this assessment.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4425

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://sunuf.co.za/XSRYdR1H?utm_term=urosepsis+pathophysiology+pdf+download+pdf
    • https://foluxodemebomo.weebly.com/uploads/1/3/0/7/130739593/ad213.pdf
    • http://szablon10.jetweb.pl/panel/kcfinder/upload/files/fojiwa.pdf
    • https://fupevigojajoma.weebly.com/uploads/1/3/0/7/130738700/fenarip_sifutiganesine.pdf
    • https://jadufebifov.weebly.com/uploads/1/3/4/6/134627690/12464c1fee5039c.pdf
    • https://ludebopukum.weebly.com/uploads/1/3/1/3/131380916/6844632.pdf
    • https://fomutifimo.weebly.com/uploads/1/3/4/5/134594787/safifefekij-toxafidaxuze-rimalafusivofen.pdf
    • http://gewald.ru/content/Files/mikesexalopagepejotij.pdf
    • https://letuwolisabir.weebly.com/uploads/1/3/4/6/134602086/folufadaje_vamenujaduneva_limupafut.pdf
    • http://chamdure.com/DATA/files/gibirisakisixezizuduno.pdf
    • https://rajilogibakew.weebly.com/uploads/1/3/5/3/135326989/dugojanak-gabaj.pdf
    • http://indigobaby.eu/upload/files/62158333094.pdf
    • https://mujaxelixoduren.weebly.com/uploads/1/3/3/9/133997177/fasimam_wesaxa_betikijisib_miduwona.pdf
    • http://transcash.com/ci/userfiles/files/paxileporisara.pdf
    • https://potezevaledu.weebly.com/uploads/1/3/1/4/131406960/09958bd52c.pdf
    • https://zofizefeva.weebly.com/uploads/1/3/1/6/131636954/1892583.pdf
    • https://nizesipew.weebly.com/uploads/1/4/1/7/141772305/pokexekaxikofi_tipufokefev_taganiwov_fejibeg.pdf
    • https://jetujonupukoj.weebly.com/uploads/1/3/1/1/131163664/8957a8.pdf
    • https://www.3zslitomysl.cz/admin/editor/kcfinder/upload/files/gisizowamogewatal.pdf
    • https://vufilujili.weebly.com/uploads/1/4/1/3/141377118/lojumumuvizupib_rajuwebitix_karepipag_veladexuxabov.pdf
    • https://letavozogat.weebly.com/uploads/1/3/5/9/135978758/mepizomolutomewama.pdf
    • https://mixofugu.weebly.com/uploads/1/3/4/3/134351041/9098091.pdf
    • https://artasedanasingaraja.com/uploadfck/file/27965175494.pdf
    • https://zelidewa.weebly.com/uploads/1/3/4/3/134371532/3353070.pdf
    • https://ebmcordelles.progess.com/userfiles/file/rejufaxoxi.pdf
    • https://bapefakujina.weebly.com/uploads/1/3/4/4/134483882/478217.pdf
    • https://tiketutowiko.weebly.com/uploads/1/3/5/3/135345961/7045575.pdf
    • http://barcodeegypt.com/public/kcfinder/upload/files/12257051857.pdf
    • https://bowonalixatan.weebly.com/uploads/1/3/5/3/135347428/gaxuxide_rowane_napef_sibilafisaxib.pdf
    • https://mumovukejepi.weebly.com/uploads/1/3/1/4/131483147/2882803.pdf
    • http://kozlekedes.lenti.hu/feltoltes/files/muvoxosigovuniwowawop.pdf
    • https://ntct-algerie.com/ckfinder/userfiles/files/93522760471.pdf
    • http://kondicionery-vidnoe.ru/upload_picture/file/77523061261.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00064784.bin
d31201220c94aa47a7d09531239012ac88dd5c4f56aa40a5aa8f90eea3575156		 pdf-font-stream PDF embedded font (sfnt) at offset 0x64784 19380 bytes
font_01_sfnt_off00067adb.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x67ADB 16792 bytes
font_02_sfnt_off000692f4.bin
5b3f4d122a060acf26297b80d2f9509ce5ebbd39751768ee61381728141cca10		 pdf-font-stream PDF embedded font (sfnt) at offset 0x692F4 10984 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.