Malicious PDF — malware analysis report

Static analysis result for SHA-256 cce1180ba3d9517d…

MALICIOUS

PDF

74.7 KB Created: 2021-03-09 11:56:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: f37749159986fdc62985fda7ad742548 SHA-1: 21abc79d08afbc1ef29e109a610ae64161bbeae9 SHA-256: cce1180ba3d9517d590d6bb7340ae1b07e72bd1bc9d7b00317d027739898a14d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, likely for phishing purposes. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=how+to+set+up+jetpack+verizon PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4387427/normal_603a250f4179a.pdfIn PDF document text
    • https://patelevikukel.weebly.com/uploads/1/3/4/6/134665122/vunebo_zimevibepudiser.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4451221/normal_5fde54e4c9ac5.pdfIn PDF document text
    • https://diwowure.weebly.com/uploads/1/3/4/5/134592565/890393.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4407789/normal_602389216c0ec.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4389365/normal_60083014df0e8.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4404515/normal_5fc6798211ba6.pdfIn PDF document text
    • https://vukujaxirebes.weebly.com/uploads/1/3/4/1/134108713/6399971.pdfIn PDF document text
    • https://vufepuxo.weebly.com/uploads/1/3/4/5/134522835/9156011.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://6525eaf8-9a42-4119-9fb4-c3d475b3b78e.filesusr.com/ugd/80bfa9_1fe9568d9f7c4bf8be396b9babd3934a.pdf?index=trueIn PDF document text
    • https://451b78f8-089e-4d4d-bc4b-60abb621f7e6.filesusr.com/ugd/7ef0dc_203c3787d98e4895aae3909a058a8c99.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xepululejiwof/7759600165.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/18de6b4f-6bce-4099-9014-a530bb6e929e/24200163619.pdfIn PDF document text
    • https://s3.amazonaws.com/kexamoxusinixu/3690598802.pdfIn PDF document text
    • https://s3.amazonaws.com/dakebesuvum/what_s_up_best_answer.pdfIn PDF document text
    • https://fdb0147f-387d-4908-9c93-1ccdb5bf775f.filesusr.com/ugd/aea2e0_7afcbd80fa8940e696577fa744b01549.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tapelu/lesson_plan_in_english_grade_6.pdfIn PDF document text
    • https://s3.amazonaws.com/litunux/guntersville_fishing_report_october_2018.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/92be5051-5367-4a6d-85b4-84227b65dcbc/92554027604.pdfIn PDF document text
    • https://94226b1b-8363-4ad6-a779-e61b7b16ff5b.filesusr.com/ugd/b3bc21_1ff72c4a7f2045af835ea12a5ea666c0.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/4d976700-d32e-424c-b21a-0ffd1ccf87d6/the_kargil_girl_full_movie_watch_online.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/21ba0f06-62cb-4765-9e6a-5b00deb24f8f/33261077277.pdfIn PDF document text
    • https://s3.amazonaws.com/jukoxisojow/borderless_gaming_8._4_free.pdfIn PDF document text
    • https://s3.amazonaws.com/budovewesekaz/nice_guidelines_menopause_2017.pdfIn PDF document text
    • https://a72b158e-cead-41d6-a0b3-8518216316a4.filesusr.com/ugd/35c6e2_c814209c1a6e4f0d868e749ffd7eab96.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e7bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE7BB 5200 bytes
SHA-256: 0c94dc0b2db29982013abbcbbf77f437cc0e26c174785791069ac97e537ca38f
font_01_sfnt_off0000f99b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF99B 10284 bytes
SHA-256: cd25e2a42b0a980dfd789814e5cf0c14f2860dfe3015e1f2249ff7cc98123a0f

Open this report in the interactive analyzer, or submit your own file for analysis.