Malicious PDF — malware analysis report

Static analysis result for SHA-256 cec4081ddd002a91…

MALICIOUS

PDF

70.0 KB Created: 2021-03-24 06:43:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ccf2144dae2227b8671aee054a7e6e4a SHA-1: 892fe723edcf0a6ae2edd600edcceee0f506d601 SHA-256: cec4081ddd002a9114477c080be4e319839e8f26261dd1812167e6a8a978f310
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a machine learning classifier and ClamAV, indicating malicious content. The embedded URL points to a suspicious domain, likely serving as a lure for phishing or malware. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest an attempt to redirect the user to a malicious site, aligning with spearphishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/wix?keyword=mla+citation+practice+worksheet+high+school
    • http://blockingscenery.com/23940425927isihj.pdf
    • http://sosed.market/68956034138hfwso.pdf
    • http://cafe-cok.ru/gta_5_casino_glitchdc1ve.pdf
    • http://qrastenmap.online/small_instagram_logo_for_business_cardl5lte.pdf
    • http://instapriz.online/most_important_wilderness_survival_skillsnyai3.pdf
    • http://meetchat.space/bisudu9fswp.pdf
    • http://salonly.xyz/3791602168613q1t.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/5d6aa2a9-68bd-4095-a079-4bba3bd26a5f/ziladoboxubup.pdf
    • https://s3.amazonaws.com/regegozumekoza/87847078072.pdf
    • https://uploads.strikinglycdn.com/files/a297d916-e5e2-4937-8067-e6e157595479/dedamezobukit.pdf
    • https://uploads.strikinglycdn.com/files/54cee907-55cf-44fd-b9fd-c96c2f115fce/570671594.pdf
    • https://uploads.strikinglycdn.com/files/d86d349f-a529-4e94-b06c-d64830d17cfa/how_much_does_a_2nd_grade_teacher_make_in_texas.pdf
    • https://uploads.strikinglycdn.com/files/b8f53413-f185-4741-b78f-1d6f2dceebcc/how_to_read_aviation_charts.pdf
    • https://uploads.strikinglycdn.com/files/e426716e-f2e8-4423-a3f1-07ac8e2ee1aa/hampton_bay_200_watt_digital_transformer_instructions.pdf
    • https://s3.amazonaws.com/legesiliv/97092251408.pdf
    • https://uploads.strikinglycdn.com/files/7967c283-150e-4d79-8850-def7df058e02/wayne_dalton_garage_door_opener_reset_button.pdf
    • https://s3.amazonaws.com/galinikagopit/rental_lease_agreement_template_florida.pdf
    • https://uploads.strikinglycdn.com/files/32febc63-167e-41f8-a3db-12f55023f7d2/speed_distance_time_graphs_worksheets.pdf
    • https://s3.amazonaws.com/wazagidonux/68833732913.pdf
    • https://uploads.strikinglycdn.com/files/46e70e54-7935-423b-8b61-13e6a0ec0a0e/linitu.pdf
    • https://s3.amazonaws.com/takurugilij/gufezivu.pdf
    • https://uploads.strikinglycdn.com/files/910d273b-8f93-469b-bbfa-68216fc710d8/ediciones_paulinas_nuevo_diccionario_de_teologia_biblica_02.pdf.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d198.bin
a0a3b60e095b85d22c3edea34999fca3aacf6a8c3ef73a20c43bf57485df2aeb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD198 5356 bytes
font_01_sfnt_off0000e3ea.bin
a2070793b7953553879bd78ee556950ef8f4d8371c6280ffca15c783e003c828		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE3EA 11600 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.