Malicious PDF — malware analysis report

Static analysis result for SHA-256 cd995bf879b0b51c…

MALICIOUS

PDF

75.6 KB Created: 2021-05-06 16:06:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dcd348c81250d3fc12b08bc0d1ecbfc1 SHA-1: 9e858026df0c8aba976f64c7660c2b9e30c8a0ef SHA-256: cd995bf879b0b51cd2f5addc14f0a3b783d0c6f594eb1efe0f5985e9cffd8999
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. The embedded URLs suggest an attempt to host or link to malicious content, likely a second-stage payload. While no scripts were explicitly extracted, the PDF structure and embedded URIs indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://frennphotography.com/wp-content/plugins/formcraft/file-upload/server/content/files/16077854b5f8ce---juzejozetalilamu.pdf
    • https://www.glasswindowequipment.com/wp-content/plugins/super-forms/uploads/php/files/9f62ed548da4bd300a4a813bb49ba853/25382641293.pdf
    • https://uaqbakery.com/wp-content/plugins/formcraft/file-upload/server/content/files/160814b371cd25---45124715045.pdf
    • http://edu-family72.ru/content/images/uploads/file/13982617389.pdf
    • https://envomask.com/wp-content/plugins/super-forms/uploads/php/files/11c834e1b4aed9fa66a599f152aa1443/79077944304.pdf
    • http://www.circoloaletrium.it/wp-content/plugins/formcraft/file-upload/server/content/files/1609269adbbbd8---76564679386.pdf
    • http://lookupagency.es/wp-content/plugins/formcraft/file-upload/server/content/files/160818d5d2cc7b---10272324058.pdf
    • https://www.rogierstoel.nl/wp-content/plugins/super-forms/uploads/php/files/ffeareae2sisbkthpqdlnsrsls/murimekedutiripofimenukor.pdf
    • http://www.christinemartin.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/16090f202bcd56---gijoroxagivigadu.pdf
    • https://www.enterpriselighting.com/wp-content/plugins/super-forms/uploads/php/files/ec7277c592ca93795ba1c7c2e965b316/46941684609.pdf
    • https://big-cash.de/wp-content/plugins/super-forms/uploads/php/files/dhc5u57h158o3f32s94i8t9fl3/gutavamivulejeves.pdf
    • https://www.espymetcalf.com/wp-content/plugins/formcraft/file-upload/server/content/files/16082b1c1d6ad0---diposudiwaraxe.pdf
    • http://cuatro-pr.org/sites/default/files/file/46635382572.pdf
    • https://118highschool.am/wp-content/plugins/super-forms/uploads/php/files/54a6f215b32a87422d66b313ae05180e/1620681993.pdf
    • https://2greenchicks.com/wp-content/plugins/super-forms/uploads/php/files/1fff414a8c9b59dcbfeb16469166fb9c/wofogona.pdf
    • https://awlights.com/wp-content/plugins/super-forms/uploads/php/files/0cbacdadcb5a61238e37d4ba6edbdbcd/bigog.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/6naE_Nh8_CY/uplcv?utm_term=kallyas+html+template
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea74.bin
d1ce0c9687c4e1cfb43ac03082150fbe57d3fca1da27694a8e16cb2af6cf9734		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA74 5032 bytes
font_01_sfnt_off0000fb7a.bin
1a75265899e72a45b44b85c9be49945b862b3026596c6a78aa0be62bdbd1d1b9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB7A 11396 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.