Malicious PDF — malware analysis report

Static analysis result for SHA-256 cf15be0b11ca628b…

MALICIOUS

PDF

88.9 KB Created: 2021-04-11 05:56:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f77116e9c467a86915853554a568cab7 SHA-1: 572efb8d3edc950655f3ced2562ac9f6d5e5da5a SHA-256: cf15be0b11ca628b5b6949d5a85a181665a63bb79e76ee97947474d2276392d5
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, likely intended to trick the user into visiting a phishing or malware distribution site. The document body, though heavily obfuscated, contains text related to labor signs, suggesting a social engineering lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9983

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=is+being+emotional+an+early+sign+of+labor
    • http://kismykeitio.best/csgo_copy_pasta7fd5h.pdf
    • https://cdn.sqhk.co/manaruparil/IjaJOgd/turbo_download_manager_and_browser_apk.pdf
    • https://cdn.sqhk.co/pixafosabow/cXiewgf/40835433858.pdf
    • https://cdn.sqhk.co/vurifozi/heQhcGO/best_block_breaker_games.pdf
    • http://prosale.company/joss_whedon_wonder_woman_draftid006.pdf
    • https://cdn.sqhk.co/jesisuvov/cid1jhd/46249980028.pdf
    • https://cdn.sqhk.co/zirizowesaw/AThgVia/disable_windows_key_toggle.pdf
    • http://converstarget.ru/semowawa2wh.pdf
    • https://cdn.sqhk.co/wuwexosul/jjPpOjg/bugiremokovexafojog.pdf
    • https://cdn.sqhk.co/dojopaxitovi/jhIFIOf/diskdigger_photo_recovery_pro_apk_download_free.pdf
    • http://medyayazilimtr.com/simuwegezt8ho.pdf
    • https://cdn.sqhk.co/kebabefepu/gicUjau/android_auto_wireless_ford_sync_3.pdf
    • https://cdn.sqhk.co/butemobe/gteckgf/rpg_sound_mixer_cracked.pdf
    • http://simcars.ru/rekilubulurowogejajar2pvn8.pdf
    • https://cdn.sqhk.co/rexukewanej/ibCOcXr/bojuvujogawiritumo.pdf
    • https://cdn.sqhk.co/vuluzazogur/etytjiw/new_ringtones_and_wallpapers_free_download.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/d9faa13b-c120-46f0-ade1-5a22e80339ea/old_skool_vans_black_mens_sale.pdf
    • https://uploads.strikinglycdn.com/files/31566d07-bcf5-4853-a516-d1a5c4df0ea2/duferubekagusuxupibunen.pdf
    • https://uploads.strikinglycdn.com/files/1578d063-f60d-4d24-999e-752bd38ceade/94041373417.pdf
    • https://uploads.strikinglycdn.com/files/673b549d-6467-4d70-abc4-8d7b65942148/mizejizojuviwopujofid.pdf
    • https://uploads.strikinglycdn.com/files/634759d7-7e6d-4963-957a-4282d29a7ccf/31683243808.pdf
    • https://uploads.strikinglycdn.com/files/a8f195ee-e1fb-4626-89ea-410f35942e87/96084803351.pdf
    • https://uploads.strikinglycdn.com/files/e4f6a657-0b48-4125-8e7e-2af53360e26c/best_ralph_waldo_emerson_quotes.pdf
    • https://uploads.strikinglycdn.com/files/c23b24d0-7ffe-495a-a632-6be043930cfc/bojixosukubimekifawaduteg.pdf
    • https://uploads.strikinglycdn.com/files/54f1d936-787d-45f0-9caa-e22a9e16c254/what_kind_of_bread_can_you_eat_on_low_fodmap_diet.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fe0d.bin
66c12c21a79be87edfb05eec9227ad6fa63518881cf9a65bb0ae3930020a8415		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE0D 5264 bytes
font_01_sfnt_off00010fdc.bin
5b3be2c270682321bde4933f61a65cb25d03c2229936f5ae755ae22fb52fed98		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10FDC 2108 bytes
font_02_sfnt_off00011973.bin
be400699cf2df300797a1394d1a3e80c5f7a89331c4d5ccd07d14ca8265e2d7b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11973 11144 bytes
font_03_sfnt_off00013f7c.bin
028dbaa76d48ae99b02248bacea50134e27ed131f5dd39e25ac401de8961e19b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13F7C 16312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.