Malicious PDF — malware analysis report

Static analysis result for SHA-256 d10f394e95cd50b7…

MALICIOUS

PDF

70.5 KB Created: 2021-01-06 03:29:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12
MD5: cee3fb0c7a67cf35640ef646720eac1c SHA-1: b0544f47c33c3343ef87e892f30dd5873a201508 SHA-256: d10f394e95cd50b7f998c27659cfbbb28c8511d80fd0f6a677950fc68b0e16a2
174 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains heuristics indicating it's a malicious redirector and a callback phishing lure. The embedded URL points to known malicious infrastructure, suggesting an attempt to redirect the user to a phishing site or download further malware. The document body, though heavily obfuscated, contains text related to 'Gallagher Bassett claims reporting' and appears to be a lure for a callback scam.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/aws?utm_term=gallagher+bassett+claims+reporting In PDF document text
    • https://cdn.sqhk.co/puberufibo/bnhfjhf/veito_blade_heater_manual.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379054/normal_5f908b4689eb1.pdfIn PDF document text
    • https://cdn.sqhk.co/gugapedulob/e6DDQii/oscar_de_la_renta_bella_rosa_body_lotion.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4462376/normal_5fa545e4d7672.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4405687/normal_5fda77bab5a7f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412584/normal_5f99d7eda4382.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/73a3ee0d-dd44-45b9-bf18-f7aa3a10612e/65020847986.pdfIn PDF document text
    • https://s3.amazonaws.com/tibanepoxilibud/the_crucible_movie_questions_answer_key.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9e1eb9a3-64a2-4435-b6bb-209ac2d16738/88524951380.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/96c19ee1-cfaf-4392-98f7-82c7af8302ca/lamar_county_judicial_records_search_paris_tx.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5430f87b-afdc-4991-a2d2-56603e749436/53836277011.pdfIn PDF document text
    • https://s3.amazonaws.com/geradi/crusaders_of_light_guide_ranger.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7d0a94cc-b0cb-4c77-93ed-d09fb3d66fbe/nibukixomidi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/37c6a58a-6a37-4dea-afc0-e7409dc34a20/descargar_pelicula_cicatrices_mega_hd.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d5b8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD5B8 5520 bytes
SHA-256: 796f1fa712dc6118fd79da44324a026dac3ada4d511cef3106958219fd53043e
font_01_sfnt_off0000e84b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE84B 10748 bytes
SHA-256: 86a7a123247ca15592ade504be3a278533af2171a26a1e6067c035371a4b76c9

Open this report in the interactive analyzer, or submit your own file for analysis.