Malicious PDF — malware analysis report

Static analysis result for SHA-256 d2b128241409d880…

MALICIOUS

PDF

96.9 KB Created: 2021-03-16 23:41:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 35a20d93e7cdbf7b14dc4f95ed19ca69 SHA-1: 59cdf63ee5d41ba4af626f41fd84255a27150962 SHA-256: d2b128241409d880198d8c381ea245839354fa771f4f57ff1fe8e14a07322b36
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing site. No scripts were extracted, but the presence of external URIs and the overall detection suggest a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9978

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/wix?keyword=dreamland+japan+pdf
    • https://cdn.sqhk.co/vesagivara/igwhdjf/breadwinner_cafe_dunwoody_menu.pdf
    • https://cdn.sqhk.co/zufuxirap/heEVFgg/sound_physicians_emergency_med_of_nv_bessler.pdf
    • https://cdn.sqhk.co/vasozaponem/dftjggg/skins_us_cast_effy.pdf
    • https://cdn.sqhk.co/joxesinejag/ljbsih4/different_names_for_stealth_bomber.pdf
    • https://cdn-cms.f-static.net/uploads/4444104/normal_6032c5a526bc3.pdf
    • https://cdn.sqhk.co/jotepomi/gjjjjgf/80526569125.pdf
    • https://cdn.sqhk.co/xuwadezab/geicHjd/free_slot_games_online_no_registration.pdf
    • https://cdn.sqhk.co/novozefox/jcjZAji/dudovajazos.pdf
    • https://cdn.sqhk.co/rigowodikot/iav1jdr/disney_grand_floridian_concierge_phone_number.pdf
    • https://cdn.sqhk.co/zefafulolit/heii4of/english_to_bengali_dictionary.pdf
    • https://cdn-cms.f-static.net/uploads/4410985/normal_601e94ec53888.pdf
    • https://cdn.sqhk.co/jinubodilev/ha6lCue/dusimegasopowavu.pdf
    • https://cdn.sqhk.co/zesonixiv/F3iblFz/16494949896.pdf
    • https://cdn.sqhk.co/talexadu/cgixieK/duxovubinagakezedene.pdf
    • https://cdn.sqhk.co/dufukeraj/3Hielqo/saboxolesutiladabov.pdf
    • http://pemojubeku.iblogger.org/belt_and_road_comic_free_download.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://gemimixobisuju.epizy.com/31003053157.pdf
    • http://dodupubi.epizy.com/vertical_circular_motion.pdf
    • http://fedukiz.epizy.com/mcq_anesthesia_free.pdf
    • http://taguwepos.rf.gd/3008_cable_selection.pdf
    • http://finesukarab.rf.gd/compelling_conversations_japan.pdf
    • http://revuzulikasulo.epizy.com/migidiwavalevejobodowu.pdf
    • http://vuxibir.rf.gd/how_to_lookup_your_drivers_license_number.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000109a3.bin
38d2f833cb0dbe0cd5a3dcd011fdbf9ba9d9ba5d1f160e63411bd93dfb8bb64f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x109A3 5952 bytes
font_01_sfnt_off00011e48.bin
6d62eb32207a574f4fbfb0de4bee6c8b818955d83fd8973eb723ca39f82cccf9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11E48 5084 bytes
font_02_sfnt_off00012f7f.bin
a36eee06fef6ce219692c4ec918276ac99413e4fd1e3666e4031624f9289d620		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12F7F 1800 bytes
font_03_sfnt_off0001380c.bin
10d6351842bf7cbd744d534abe433acc35ab9386171e52273f3524acc9c4d6c7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1380C 11580 bytes
font_04_sfnt_off00015f8e.bin
975089639afea594160f6daa1ae948ffc4125994d61a9fd32dce02580f7b6b15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15F8E 16312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.