Malicious PDF — malware analysis report

Static analysis result for SHA-256 d1f74d5926308f7c…

MALICIOUS

PDF

71.9 KB Created: 2021-02-24 22:42:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 7d023a48e8d2cab3a50d1151bafe288a SHA-1: cb34309d17f1f8d6011d1205621e53edfb81c76e SHA-256: d1f74d5926308f7c2cfd14c3720f17880fdfbecb1667e2f89a5e1e543354548b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, with heuristics indicating the presence of external URIs. The document body, though heavily obfuscated, contains text fragments that, combined with the PDF_URI heuristic, suggest an attempt to direct the user to a malicious URL. The presence of embedded URLs further supports this phishing or malware distribution vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/123?utm_term=are+futures+markets+open+24+hours PDF link annotation
    • http://endi-itali.space/corporate_social_responsibility_business_studies_definition3jri5.pdfIn PDF document text
    • http://samoe-samaya.ru/pioneer_sph-da120_repairo67kj.pdfIn PDF document text
    • http://winoraama.website/black_and_decker_edger_bladesa61k1.pdfIn PDF document text
    • https://cdn.sqhk.co/vetukalujir/gfRia7g/death_park_scary_clown_survival_horror_game_download.pdfIn PDF document text
    • http://dfahsdfgjsfg.online/7564569732k34sw.pdfIn PDF document text
    • http://ketousa.site/the_book_of_unknown_americanoe133.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xeropizuwe/chairman_job_description.pdfIn PDF document text
    • https://s3.amazonaws.com/jidosatikim/39385224661.pdfIn PDF document text
    • https://s3.amazonaws.com/datarofapakil/xezaxawawakekijax.pdfIn PDF document text
    • https://s3.amazonaws.com/pevarijidasalop/rupaduxuwidokukame.pdfIn PDF document text
    • https://s3.amazonaws.com/kosamupim/necromancer_wizard_guide_5e.pdfIn PDF document text
    • https://s3.amazonaws.com/xunilukegez/26009325390.pdfIn PDF document text
    • https://s3.amazonaws.com/bufexa/bowman_s_capsule_and_glomerulus_form.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db0d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDB0D 5384 bytes
SHA-256: 8481bb762130f745e1ce12c9ec59baf0dd51e19c3ba758a6696a03984a84039b
font_01_sfnt_off0000ed39.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED39 11220 bytes
SHA-256: 7c240ecf2d12c50f43a5d63db275ea22997f5f7d687734d6d14947d99f2319b0

Open this report in the interactive analyzer, or submit your own file for analysis.