Malicious PDF — malware analysis report

Static analysis result for SHA-256 d14834e123fdbf04…

MALICIOUS

PDF

72.3 KB Created: 2021-02-28 14:32:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: aed8c76696c24cad2e35b4d3f8fcb9c5 SHA-1: 221bb756d17783c4f9f62bfe3758dca0627e795b SHA-256: d14834e123fdbf04e7d64aac7194ced65d32b8795802ef44b21627b0385413fe
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that mimics a search result for a popular TV show, likely intended to trick users into clicking it. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing or trojan PDF. The primary IOC is the malicious URL, which is likely used to deliver a secondary payload or redirect to a phishing site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=pretty+little+liars+season+4+episode+1+full+episode+free+online PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4373755/normal_5fcaebd71d363.pdfIn PDF document text
    • http://idealicaufficiale.website/pitezivagewebaminaval0lm82.pdfIn PDF document text
    • http://dilawiputonu.mypressonline.com/devi_bhagavatam_sanskrit_and_english.pdfIn PDF document text
    • http://nejevefivi.mypressonline.com/is_dork_diaries_a_nonfiction_book.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4409258/normal_5ffbd797e19c8.pdfIn PDF document text
    • http://zunuruxeguxifi.mygamesonline.org/wodame.pdfIn PDF document text
    • http://powusonuruw.22web.org/open_broadcaster_software_windows_8._1.pdfIn PDF document text
    • http://lnstagramverifiedsbadgeforms.com/game_minecraft_pokemon4ik8l.pdfIn PDF document text
    • http://s-tochka.ru/sense_and_sensibility_chapter_13_summary2455a.pdfIn PDF document text
    • http://cherrypimp.online/worm._io_crazy_gamesqar2x.pdfIn PDF document text
    • http://collegegraduatecentraldating.com/ejercicios_de_limites_algebraicos_resueltos_paso_a_paso4j49r.pdfIn PDF document text
    • http://najetaxu.mygamesonline.org/jilosadedibifi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4458848/normal_6021808b2df27.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421623/normal_6035bf38d3bc3.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/labitajaxatufib/repidadulato.pdfIn PDF document text
    • http://kuwukazisopof.rf.gd/word_letterhead_template_with_logo.pdfIn PDF document text
    • https://s3.amazonaws.com/radubozufiwo/kifopexaxega.pdfIn PDF document text
    • https://s3.amazonaws.com/jenisozazewubo/free_math_worksheets_3rd_grade_place_value.pdfIn PDF document text
    • http://tavawefojob.epizy.com/liwetit.pdfIn PDF document text
    • https://s3.amazonaws.com/zonivezada/wh_questions_exercises_worksheets.pdfIn PDF document text
    • http://pasazaxara.rf.gd/puvofipawutafofavogo.pdfIn PDF document text
    • http://zepizevut.atwebpages.com/how_to_unlock_ipod_nano.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dcf7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDCF7 5280 bytes
SHA-256: f3149905f139da2a6c428f9f9b8d555f789e8c0c9eda4a5d4c90b9c703b205b4
font_01_sfnt_off0000ef0e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF0E 10652 bytes
SHA-256: a310332624ddbdf0838acfe05a4ae48ca6a9bc874b089f6759a0493699e302bc

Open this report in the interactive analyzer, or submit your own file for analysis.