Malicious PDF — malware analysis report

Static analysis result for SHA-256 cdcbf9fa8cd197d3…

MALICIOUS

PDF

68.6 KB Created: 2021-05-19 03:22:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a63726e2a46410143622282da0cf061d SHA-1: 82733ba7caa54110feea34d832f78d2772c0e763 SHA-256: cdcbf9fa8cd197d3c9fd85ddfb4815c6b1bf82903d5ff5e163d518ee81adf817
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that likely leads to the download of a secondary payload. The document body, though heavily obfuscated, suggests a lure related to product instructions, which is a common tactic for phishing and malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://philabc.ru/uplcv?utm_term=sonru+bluetooth+5.0+transmitter+receiver+instructions
    • http://serendipityorlando.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071db8f6289e---rawupibimasebofiminudifaz.pdf
    • http://www.nbrownies.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1607f8f5c81b77---70542628278.pdf
    • http://www.gunyagder.org.tr/wp-content/plugins/super-forms/uploads/php/files/01rsgnt8fhm39f05k6a8fp9tk3/lojinutakukatafonebob.pdf
    • https://creationstationdance.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607324cda2fdf---23932335879.pdf
    • http://www.unidacardoso.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16077b241a4466---96206225781.pdf
    • https://travels-ukraine.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a418a54dc4c---vofiwubadolamovaxafovo.pdf
    • https://harpethvalleypto.org/wp-content/plugins/super-forms/uploads/php/files/b754ddde759544d16006c9376b8b6f65/nimetamov.pdf
    • https://bancodevida.com/bancodevida/admin/images/image/file/64182835184.pdf
    • https://yournew.site/wp-content/plugins/super-forms/uploads/php/files/sopq0j72rfrsboudmh8eknads7/241100678.pdf
    • https://www.ltgpartners.com/wp-content/plugins/super-forms/uploads/php/files/a3ff35954b02f6927dcf200c0d1246df/9470268923.pdf
    • https://www.isgs.org/wp-content/plugins/super-forms/uploads/php/files/e0ecdb084853e1244f1f15f6a7f034ac/33988402836.pdf
    • https://www.alignerco.ca/wp-content/plugins/super-forms/uploads/php/files/2f24bf812f7218627bccce29c550fe2c/8885574774.pdf
    • https://propbrains.com/wp-content/plugins/super-forms/uploads/php/files/79tgehspskee3po4p4rsn500p2/38161673045.pdf
    • http://www.neslihanonur.com/wp-content/plugins/super-forms/uploads/php/files/ff9cf2be62496d22c611a42e4968665d/87986298714.pdf
    • https://seataclightingalaska.com/wp-content/plugins/super-forms/uploads/php/files/f53a13f3bd992d900c816d662f2ee797/vasepawemagatobode.pdf
    • http://www.aadhar-interior.com/userfiles/file/90444409443.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cf20.bin
e12f60f73709146142bffc46e893a71b34884b8ac52c11f79da8a352986639ad		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCF20 5640 bytes
font_01_sfnt_off0000e22d.bin
46cc5c2cdf0dfee2be043d763da9dd1853f5ab48d13d6c1af49481ac58349fd2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE22D 10464 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.