Malicious PDF — malware analysis report

Static analysis result for SHA-256 cc975865453be28d…

MALICIOUS

PDF

70.9 KB Created: 2021-02-23 09:33:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-07
MD5: 847d3fbf25f2f7ce142459d83060ce71 SHA-1: 9bf200402d428cb22add5bb873d7949473b5b7f6 SHA-256: cc975865453be28d05b7e96f3409b2588ffc58de831fbf8b51eed4fff7f051a2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://maypoin.ru/wix?keyword=ertl+toys+price+guide', which is likely used to deliver a secondary payload or redirect to a phishing site. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest it's designed to exploit vulnerabilities or trick users into visiting malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=ertl+toys+price+guide PDF link annotation
    • http://wowitaly.space/euroset_3005_manualu0k9m.pdfIn PDF document text
    • https://cdn.sqhk.co/javufikari/jcjf9mF/stickman_fight_animation_maker.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4498392/normal_5fc9b418f1696.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417809/normal_6022bb9a7191d.pdfIn PDF document text
    • https://cdn.sqhk.co/tipefima/chhPixE/bimibigazaxanugusarunozel.pdfIn PDF document text
    • http://air-calm2.club/vuvizemefinesoku9e909.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388406/normal_602b70f6efa2c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418777/normal_5fd818d77a4ae.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393925/normal_5fe93cb9a472b.pdfIn PDF document text
    • https://cdn.sqhk.co/sizafutito/E3Rgjij/lg_v40_thinq_wireless_charging_not_working.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4408002/normal_5feb47970c54a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4370778/normal_600563c5667c2.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xufaxoferugod/cg_video_hd_dj.pdfIn PDF document text
    • https://s3.amazonaws.com/tobovunoberiki/43483256624.pdfIn PDF document text
    • https://s3.amazonaws.com/sabegokek/bioavailability_of_nutrients.pdfIn PDF document text
    • https://s3.amazonaws.com/nademopor/sql_server_for_xml_path_format.pdfIn PDF document text
    • https://s3.amazonaws.com/wanasuvedigo/hotel_del_luna_ost_piano_sheet.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d8fc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD8FC 5092 bytes
SHA-256: 95228d5cc8a3e105fe3afb0332642fe436e62d6f2e141630c5e1a5bcaa56fc0e
font_01_sfnt_off0000ea6c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA6C 10704 bytes
SHA-256: 8495c57df54a278a3455226ba235f2f23f9d8587a8a2a72dae747fd2c91c3588

Open this report in the interactive analyzer, or submit your own file for analysis.