Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb7db157a50a4f52…

MALICIOUS

PDF

80.8 KB Created: 2021-03-24 11:32:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e88e47b9aa4d4bfeebfa2cc079691979 SHA-1: dc0e1baf2e0801fadb3c9e5a038c487928ccb615 SHA-256: cb7db157a50a4f52025af02c03aa67652270a5f5f96b6ef4388b9bf847bf479a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that redirects to a malicious domain, likely intended to deliver a phishing page or malware. ClamAV and ML classifiers flagged this PDF as malicious, indicating a high probability of malicious intent. The document body, though heavily obfuscated, suggests a lure related to a specific manual, aligning with phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wix?keyword=padi+deep+diver+specialty+instructor+manual+pdf
    • http://lizotegek.iblogger.org/20926860796.pdf
    • http://lirifajo.sportsontheweb.net/15508764616.pdf
    • http://wow50.pro/kedisodaligafakegkegl.pdf
    • http://myluckywin.site/neruda_100_love_sonnetsx7lyn.pdf
    • https://cdn-cms.f-static.net/uploads/4459185/normal_6047b654e0f89.pdf
    • http://opensalon.xyz/bugera_v22_manuale_italianox1rsb.pdf
    • https://static.s123-cdn-static.com/uploads/4498883/normal_5ff8ab6088da8.pdf
    • https://cdn-cms.f-static.net/uploads/4489599/normal_60568d30b1d7e.pdf
    • https://cdn-cms.f-static.net/uploads/4378165/normal_602a7b75ed117.pdf
    • http://falorilipeb.mywebcommunity.org/voyager_legend_cs_replacement_headset.pdf
    • http://defiboxifef.22web.org/activity_books_for_adults.pdf
    • https://static.s123-cdn-static.com/uploads/4454040/normal_5fe2b5303396b.pdf
    • http://nejupike.mygamesonline.org/entropia_e_a_segunda_lei_da_termodinmica.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/0c942383-ecc9-4ceb-94c6-3a3bce1b8fd6/samsung_nu7100_50_price_in_india.pdf
    • https://s3.amazonaws.com/gudukupir/pubetixunejivazixa.pdf
    • http://sametil.epizy.com/85989073194.pdf
    • https://s3.amazonaws.com/xeponodij/hollywood_reporter_twitter.pdf
    • http://gapoxuvopa.onlinewebshop.net/82981780357.pdf
    • https://s3.amazonaws.com/telasebisu/king_lear_summary_act_1_scene_2.pdf
    • https://s3.amazonaws.com/wunojipu/piwabanagapijokun.pdf
    • https://s3.amazonaws.com/waduzirader/free_online_graphic_design_software_no.pdf
    • https://uploads.strikinglycdn.com/files/6ae83a13-e6f6-4ef7-a0a6-b686b7e81605/1861254257.pdf
    • http://dexadusoxeb.atwebpages.com/ctet_feb_2020_answer_key.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e70a.bin
827be080eb382add67bd4a149fb0a6e08399939d40cab21e129a9a2b96a067cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE70A 5464 bytes
font_01_sfnt_off0000f99e.bin
663e2dbfe23bfa591184b2c58d29dfd271eca63ac9e9584c17aa178cfb8eb909		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF99E 11724 bytes
font_02_sfnt_off00011fb9.bin
c988415812f594187b0a0ed75dc52802e798e1695b49bd300f8412a65040a449		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11FB9 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.