Malicious PDF — malware analysis report

Static analysis result for SHA-256 cf01508d5392e210…

MALICIOUS

PDF

103.6 KB Created: 2021-03-22 20:58:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: aa072a704b0d4462708859421094360d SHA-1: d179a6dae72116c035a4b18250fa4228e4ae0cb7 SHA-256: cf01508d5392e210279f934f4e22317e4fb1af4621fea1a357e7454ea250640e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that leads to a suspicious domain, likely intended to host a malicious payload or phishing page. The document body, though heavily obfuscated, suggests a lure related to 'prayer beads buddha meaning'. No scripts were extracted, but the presence of external URIs and the overall detection profile strongly indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/aws?utm_term=prayer+beads+buddha+meaning
    • http://walifevapeju.22web.org/the_role_of_agriculture_in_african_development.pdf
    • http://tofotibuwul.sportsontheweb.net/accounting_information_system_free_download.pdf
    • http://vukuradi.mygamesonline.org/bidunozakije.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://fedorahosted.org/lohit
    • https://uploads.strikinglycdn.com/files/e34d739b-7b46-4359-8275-fa0fca6e336d/dewalt_compound_miter_saw_dw708_manual.pdf
    • http://dosekidonara.epizy.com/dilodemebepewi.pdf
    • https://s3.amazonaws.com/sowirutelevolur/risurunavejujubopi.pdf
    • https://s3.amazonaws.com/pidufozu/free_blank_funeral_program_templates.pdf
    • http://lobaman.epizy.com/50210324717.pdf
    • https://s3.amazonaws.com/xasovewipeje/human_body_systems_worksheet.pdf
    • http://towilisok.epizy.com/dobijalujefexol.pdf
    • https://uploads.strikinglycdn.com/files/40734798-6056-43cc-9142-b60ea0ff15da/what_does_typography_mean_in_language_arts.pdf
    • https://s3.amazonaws.com/zidosozawok/rirumisapegixuxokiw.pdf
    • http://kufelinal.rf.gd/xagivanibat.pdf
    • http://vaxalisuj.rf.gd/professional_boxing_training_program.pdf
    • https://uploads.strikinglycdn.com/files/f8577653-5f39-4c16-af22-06813c96d972/kodufuwamaforaga.pdf
    • http://vidabovon.epizy.com/tariwuga.pdf
    • https://uploads.strikinglycdn.com/files/57dcb96a-1a67-491b-b8a8-41ff7f8a2a91/korg_sv1_manual.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://scripts.sil.org

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011496.bin
7add2219fb76ef46c104b2015c1d63ed340d731d910ecc2b6ab092b9b723b8b5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11496 6324 bytes
font_01_sfnt_off000129df.bin
b3734bf798ae187ddaf5671aa8e5973ed3752255e0118ef82ed70b8f45f6dfd1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x129DF 5144 bytes
font_02_sfnt_off00013b20.bin
3fb0c2b76c3376f18bfa967e5b3ee3e1b01703c62809900df97c1a7cb2488555		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13B20 14488 bytes
font_03_sfnt_off00016898.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16898 4324 bytes
font_04_sfnt_off00017697.bin
e145846080c0066e8f972933f16019e3719c959367ad671e4669c901cf59cedd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17697 2492 bytes
font_05_sfnt_off000180da.bin
247f4e6cbc69c002ba8ee30cdeabd2fd72b696b958d4422dae86e72131221e9c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x180DA 4496 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.