Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce94684512334958…

MALICIOUS

PDF

74.2 KB Created: 2021-03-31 03:42:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 35e63db2906059c05c7fa821b62ea834 SHA-1: 295df1d6c66e4d8bc83145eda34f8915eb17e081 SHA-256: ce94684512334958aac886901836d0a665d5d4ad92492575c5cf93d3dc614dc5
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains an embedded URI pointing to a suspicious domain, likely intended to trick the user into downloading a fake service manual. While no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to exploit user trust for malicious purposes.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=honda+90+hp+outboard+service+manual
    • https://cdn-cms.f-static.net/uploads/4426257/normal_605d8ecaf1ed7.pdf
    • http://musomojil.mywebcommunity.org/vitusaritul.pdf
    • http://relodifalixogo.scienceontheweb.net/63005597590.pdf
    • http://sibogufurab.medianewsonline.com/monash_fodmaps_list.pdf
    • http://bumosid.getenjoyment.net/18421809253.pdf
    • https://cdn.sqhk.co/xolafunodo/ijea3hj/59027193774.pdf
    • https://static.s123-cdn-static.com/uploads/4366324/normal_5fcf9c3778413.pdf
    • https://cdn-cms.f-static.net/uploads/4379732/normal_6031113e8b48e.pdf
    • http://manidat.sportsontheweb.net/89308977685.pdf
    • https://cdn.sqhk.co/kuwusemob/kijchgo/visolonos.pdf
    • https://cdn.sqhk.co/zodunoxurob/j2hgjje/rush_hour_1998_full_movie_in_english.pdf
    • https://static.s123-cdn-static.com/uploads/4371523/normal_5fd06fe03b080.pdf
    • https://cdn.sqhk.co/bufudoraxala/T1piajh/the_roman_empire_netflix_order_to_watch.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/0b0ddfc8-ea39-43f6-884b-f1dd51567ff7/44143714229.pdf
    • https://uploads.strikinglycdn.com/files/1cabedad-cd8a-4981-a7ae-16f3fe37b95e/tipojiwoganigegagofenited.pdf
    • http://mujebik.atwebpages.com/38119038370.pdf
    • https://uploads.strikinglycdn.com/files/6f9b2a91-19e5-4502-ab10-abbde3530030/the_unbearable_lightness_of_being_review.pdf
    • https://uploads.strikinglycdn.com/files/2cf8bb73-2765-4814-bf48-439f634c9774/herman_miller_aeron_refurbished_chair.pdf
    • https://uploads.strikinglycdn.com/files/ce2f78fa-7e38-4e22-ba57-8eba4021ce36/woxexugafikedomesom.pdf
    • https://uploads.strikinglycdn.com/files/3a9ba6eb-c8eb-4da1-81e0-4ec4f0e56dd5/vivint_thermostat_not_working.pdf
    • https://uploads.strikinglycdn.com/files/668ced85-191f-4c2d-9ad3-7d2256e92dcc/separation_process_principles_with_applications_using_process.pdf
    • https://uploads.strikinglycdn.com/files/fdbb8c35-6b96-4c3d-a693-9c411bf8b29f/warrior_cats_books_online_omen_of_the_stars.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e3e3.bin
bd7b671bbcf0631d49719ff4be269d7d59f46cc6883c5a1185d35dcf12fe4606		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE3E3 5772 bytes
font_01_sfnt_off0000f758.bin
fe66a8402d8291e128c1280da01e33876e05f18e4c77c57b66d54ae45cf12aba		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF758 10860 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.