Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb848072f1d7debb…

MALICIOUS

PDF

79.5 KB Created: 2021-05-16 21:25:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 69f2f7176bb489b5e9f7c454236dc560 SHA-1: a8abcc323463a936cee853e557f3a0cef49ce6a6 SHA-256: cb848072f1d7debb4b82ffe85654cd573a0cf0fc8019e684c0f9d08eab1f4838
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing a link to a known malicious redirector, identified by the heuristic PDF_MALICIOUS_REDIRECTOR_LINK. The ML classifier and ClamAV also flagged this PDF as malicious, specifically as a phishing trojan. The embedded URL likely serves as a lure to download further malicious content or redirect to a phishing site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/strik?utm_term=driver+mixer+yamaha+mg10xuf In PDF document text
    • https://cdn.sqhk.co/liregevo/CggOqgd/what_chart_categorizes_information.pdfIn PDF document text
    • https://cdn.sqhk.co/dofofigeniso/Bciegie/62357629617.pdfIn PDF document text
    • https://cdn.sqhk.co/furugilenu/jcjhOha/shopping_list_app_that_can_be_shared.pdfIn PDF document text
    • https://cdn.sqhk.co/mevexobuzur/iejdheA/14455095027.pdfIn PDF document text
    • https://cdn.sqhk.co/sepunaro/hgjibiJ/ib_chemistry_ia_guide.pdfIn PDF document text
    • https://cdn.sqhk.co/nowagenika/jvYh29L/7994327138.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/054f14f3-1002-4981-ba0d-9a6f567da3c7/attack_on_titan_season_4_how_many_episodes_total.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fb00e22b-c171-48a1-b1ec-440e5af20926/wupup.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/31feefbc-1b33-42f8-aa97-0d8491500e18/41343914230.pdfIn PDF document text
    • https://s3.amazonaws.com/sitok/66165864840.pdfIn PDF document text
    • https://s3.amazonaws.com/fajetufekejo/57109686735.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8e156f16-518e-4d58-9409-a23d4b59c109/how_to_do_a_picture_search_on_ipad.pdfIn PDF document text
    • https://s3.amazonaws.com/napejaxosinages/independent_and_dependent_events_worksheet_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ae96b90d-d642-4a79-84dc-2c5107c96c7b/72393530951.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bc4c9947-76b9-415c-84ea-1285cc829756/xikujiboxepodafovagumu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/50a3a1ae-8f5a-4bd0-87a3-19d5e14fa4c1/what_is_the_thesis_of_the_communist_manifesto.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/21ea3c2d-b0ed-466e-a7af-4fa3e3e2bb15/3665697995.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0b49873f-2fe9-4b45-9646-14cb290e694a/parallelogram_worksheet_kuta.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/63a96015-6b9f-416c-b19d-e3902ab745ac/do_u_need_a_license_to_do_eyelash_extensions.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4b5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF4B5 5392 bytes
SHA-256: 8483ba6d2a502e3e4975518ccaab68895e0ae8ad648e8effc8e327a544600b38
font_01_sfnt_off00010704.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10704 12444 bytes
SHA-256: 19dc536108a0706bb4c6e2cd56ca83f826fafaf5b6d0314b6b0871492b67eb2a

Open this report in the interactive analyzer, or submit your own file for analysis.