Malicious PDF — malware analysis report

Static analysis result for SHA-256 d442158a08bc1ffb…

MALICIOUS

PDF

111.1 KB Created: 2021-03-14 16:08:25 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fc9ad6ad4ebaf9da05da190b7eb48c40 SHA-1: 773571df883e6aac3d5993a8337e0f6a1c53de64 SHA-256: d442158a08bc1ffbb7e82f4f7abf48e3d02a1c5dcaa6a5952f2772fc003b070d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that masquerades as a search result for legitimate content, likely to trick users into clicking it. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing or trojan PDF. No scripts were extracted, but the presence of a suspicious URL and the document's structure suggest a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9960

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=clement+of+alexandria+books+pdf
    • https://cdn.sqhk.co/nububufi/egfvjjf/easy_money_play_game_earn_rewards_apk.pdf
    • https://cdn.sqhk.co/semejegofip/Bif9dwv/homeschool_connections_cost.pdf
    • https://cdn.sqhk.co/kurotevu/idqIX3W/tom_and_jerry_movie_2021_twitter.pdf
    • https://static.s123-cdn-static.com/uploads/4459025/normal_5fdfbb92a200e.pdf
    • http://talemine.getenjoyment.net/how_much_is_a_rainbow_fish.pdf
    • https://static.s123-cdn-static.com/uploads/4390074/normal_5fe10999ae973.pdf
    • https://cdn-cms.f-static.net/uploads/4465133/normal_60304379cac77.pdf
    • http://miromawetibikew.mywebcommunity.org/xilog.pdf
    • https://fazerirusabutef.weebly.com/uploads/1/3/1/3/131381144/muvira.pdf
    • https://talowitutujuf.weebly.com/uploads/1/3/3/9/133999148/zixupirumuzobunu.pdf
    • http://rogosevit.22web.org/water_bottle_labels_sheets.pdf
    • https://cdn-cms.f-static.net/uploads/4444852/normal_604daac0c9a53.pdf
    • https://cdn.sqhk.co/pixazizaze/zNifgcj/small_live_tabletop_christmas_tree.pdf
    • https://gogabaxada.weebly.com/uploads/1/3/4/8/134852864/5273286.pdf
    • https://static.s123-cdn-static.com/uploads/4426422/normal_5fddfb60492e4.pdf
    • https://degegoza.weebly.com/uploads/1/3/0/8/130873855/gukidamakelu.pdf
    • http://zikewexer.scienceontheweb.net/how_to_find_my_bosch_oven_model_number.pdf
    • https://cdn.sqhk.co/zarepowake/iewddHQ/free_casino_games_slots_777.pdf
    • https://penoruzeni.weebly.com/uploads/1/3/4/1/134132400/pofonigok.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://supajiwa.myartsonline.com/merriam_webster_dictionary_free.pdf
    • http://tebaputazaxuva.myartsonline.com/54858819480.pdf
    • http://pojoviraxerojo.myartsonline.com/biblia_cristiana_dios_habla_hoy_gratis.pdf
    • http://lumawasisoxo.rf.gd/xaputixuzozerofofi.pdf
    • http://manosotidokef.myartsonline.com/14232588440.pdf
    • http://pazabod.epizy.com/how_to_do_algorithmic_trading_in_india.pdf
    • http://juruzozesema.epizy.com/digitization_ppt_templates.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00016b12.bin
a6b0e856f1a755ba6fa97409f67bb0c3019251094f607dd80cadc987d497254c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16B12 5364 bytes
font_01_sfnt_off00017d36.bin
affb3a912df0f4eae20e6a49d031317d3d096a2ae46930ea8f40cd7b33e08996		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17D36 16420 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.