Malicious PDF — malware analysis report

Static analysis result for SHA-256 cfe706451e08e1d2…

MALICIOUS

PDF

79.4 KB Created: 2021-04-24 23:44:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 17482aa784e2e16eeea8964e98322b36 SHA-1: d596e73f7cadcb7e2085b5ce5bc40d13f734b5e5 SHA-256: cfe706451e08e1d28ac42e8bebf62e90993d9204139d0083517d3e05b8a8aead
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating an external URI and embedded URLs, with one URL pointing to a domain associated with phishing. The ML classifier and ClamAV detection strongly suggest malicious intent. Although no scripts were explicitly extracted, the presence of embedded URLs and the phishing-related content indicate an attempt to redirect users to malicious sites, likely for credential harvesting or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=tarot+deck+and+book+set+for+dummies+pdf
    • http://stylecurtains.com/60078253652o0ki7.pdf
    • https://cdn.sqhk.co/jogekiluse/Pieathf/1790464624.pdf
    • https://cdn.sqhk.co/mobobelelu/hggcMKu/gokugerikileberanimit.pdf
    • http://webdefilmizle.com/pusasatisixibaxisovadfbv8.pdf
    • https://cdn.sqhk.co/wezopexa/iWijAif/drag_racing_3d_offline_mod_apk.pdf
    • http://iwhite.space/nilobuduybmg.pdf
    • http://fb-pageunderreview.com/norivaspg7mx.pdf
    • http://twitter-center.com/best_movies_of_2020_imdb3bit4.pdf
    • https://cdn.sqhk.co/xumesapaxoku/igNkXqO/amazon._com_store_card_services_phone_number.pdf
    • https://cdn.sqhk.co/xojurolaruk/hd4hgge/koala_facts_national_geographic.pdf
    • https://cdn.sqhk.co/vopofuxo/RSgexjg/jekeniribaliditefovi.pdf
    • https://cdn.sqhk.co/waxusuxagaki/drifhhk/fivefetuxi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/31dbc5f0-d9b0-4bfd-b7bb-2b8c57c3d03c/free_license_key_for_powersaves_3ds_generator.pdf
    • https://uploads.strikinglycdn.com/files/68500810-5fe9-4e7c-a874-67f24291e43d/fifebijofatatoramojodoto.pdf
    • https://s3.amazonaws.com/tolivajupeku/nuxonijutamer.pdf
    • https://uploads.strikinglycdn.com/files/21d48c7e-58b0-4699-861c-505d3d38728d/2099213816.pdf
    • https://uploads.strikinglycdn.com/files/cc5a3e8f-9854-478b-9998-d399f0b5fd6b/how_to_fill_up_canon_ink_cartridges.pdf
    • https://uploads.strikinglycdn.com/files/cf75a678-d441-4a35-81c9-9f116d494670/bapixifubatizawevalitojax.pdf
    • https://s3.amazonaws.com/xirixepo/22377294976.pdf
    • https://uploads.strikinglycdn.com/files/34c21986-ed7a-4b72-a442-b8802664fe65/confessions_of_an_english_opium_eater_by_thomas_de_quincey.pdf
    • https://uploads.strikinglycdn.com/files/915dfa76-edb4-444a-977a-e670494abca3/how_to_program_xfinity_xr11_remote_to_tv.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f688.bin
61323aa980cfdddb261d70082f6ed9c62e77f3c647c6f4548a5325b56f65b5da		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF688 5424 bytes
font_01_sfnt_off000108e1.bin
60493569c3ab94edc00f0ae8d6d7be426548a331af11581f06fe9e4aec2ec896		 pdf-font-stream PDF embedded font (sfnt) at offset 0x108E1 11036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.