Malicious PDF — malware analysis report

Static analysis result for SHA-256 d021b2b2bb863ade…

MALICIOUS

PDF

75.1 KB Created: 2021-03-22 21:06:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8b94520c902fdf261fcd9678efbf2361 SHA-1: 73702cf92989b05d3b544d930dc0379cb9cf7bad SHA-256: d021b2b2bb863ade7fc2f200d49ba6d176fbbf00b0bbc5e3a9ac25a0c399b1de
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a suspicious domain. ClamAV and ML classifiers flagged this PDF as malicious, specifically identifying it as a phishing trojan. The document body, though heavily obfuscated, appears to be related to the embedded URL's keyword, suggesting a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wix?keyword=what+is+salinization+in+tagalog
    • https://cdn.sqhk.co/jogeguzotire/Rkjhvib/cute_girl_avatar_creator.pdf
    • https://cdn.sqhk.co/fapewakuw/fhj8gcV/facebook_lite_login_online.pdf
    • https://cdn-cms.f-static.net/uploads/4415524/normal_600cfd4240034.pdf
    • https://cdn.sqhk.co/gidenateg/xidhegd/pisefewuwufo.pdf
    • https://static.s123-cdn-static.com/uploads/4460981/normal_5ff41981ad4a6.pdf
    • https://cdn.sqhk.co/golizojuw/RjhaQJZ/61977264637.pdf
    • http://liketime.fun/warcraft_2_cheats1ibuc.pdf
    • https://cdn.sqhk.co/jabupexipa/9UOWTHE/pevatad.pdf
    • http://iglivesupportteam.com/22410875399kh8y2.pdf
    • https://cdn.sqhk.co/xawefigi/aih3nHB/omni_notes_android.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://xuwarojuvewibi.rf.gd/christmas_carol_jim_carrey_cast.pdf
    • https://ddf64d59-5240-4154-9987-17dfc28e22c7.filesusr.com/ugd/cec570_4a7a65e0b0c94c45af038f3a3d3311ed.pdf?index=true
    • https://ecab545c-19d2-4654-b6ac-fb8b9749f5ba.filesusr.com/ugd/e5412a_d73e678d01d64e77b859f9c8b55f7520.pdf?index=true
    • http://ximolamerojizud.epizy.com/15225048360.pdf
    • http://fujumel.rf.gd/57504219460.pdf
    • https://e6f9d1db-9bad-45ba-a188-0e8e378e8087.filesusr.com/ugd/99b222_40a072b291b548feaeb81d3aa85effd8.pdf?index=true
    • http://ritarejameja.epizy.com/59672981374.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e500.bin
2a63ac76211f27133ee41f5ebad18bde9b86b3d89c7a32d3688103d61f21e3d2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE500 4916 bytes
font_01_sfnt_off0000f5ce.bin
49c009e3c4d96008105489b8a736b0717bc1b160b563bf7146eb2072cc973a29		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF5CE 12748 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.