Malicious PDF — malware analysis report

Static analysis result for SHA-256 d57ba21bf534fda0…

MALICIOUS

PDF

87.0 KB Created: 2021-03-23 00:46:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5c96ca9d1c62fcba4be80e614eb63662 SHA-1: 97d6083f3e669d312c175cc39fad179aba4972a3 SHA-256: d57ba21bf534fda068b7972ebbfad24fc38783e784dac0cda04c7bba8cbbc124
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, indicating a high likelihood of malware. It contains an embedded URL pointing to a suspicious domain, likely used as a lure for phishing or to download a secondary payload. The document body, though heavily obfuscated, suggests a pretext related to job opportunities, aligning with common phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9983

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/aws?utm_term=international+finance+jobs+in+africa
    • https://cdn-cms.f-static.net/uploads/4387419/normal_601cfd2ee86fb.pdf
    • http://chelamela.org/84263618028b22dc.pdf
    • http://mini-cam1.club/governor_of_poker_3_latest_apk9slta.pdf
    • https://cdn-cms.f-static.net/uploads/4410006/normal_5fe83dedf2a51.pdf
    • https://cdn-cms.f-static.net/uploads/4369514/normal_603464fc79c76.pdf
    • http://sexedate69.site/radio_button_onclicklistener_androidjvi84.pdf
    • http://nemekarasika.iblogger.org/white_christmas_guitar_sheet_music.pdf
    • http://changepass.online/how_to_rebuild_small_block_chevyu0r76.pdf
    • http://siradiru.22web.org/alistair_cockburn_writing_effective_use_cases_download.pdf
    • https://cdn-cms.f-static.net/uploads/4483867/normal_602ae885876f1.pdf
    • https://cdn-cms.f-static.net/uploads/4465398/normal_6048fe106e39c.pdf
    • http://nepasise.iblogger.org/como_transformar_celsius_em_kelvin.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/36bdffee-ed9e-4efd-bba3-9a7f85666283/sanukidemefoveranapumadu.pdf
    • http://natexekazedap.epizy.com/family_loan_agreement_template_ireland.pdf
    • https://uploads.strikinglycdn.com/files/07fc6390-fc5c-4618-bf9d-a84d72f2259d/poxifemidenotababatesuj.pdf
    • https://uploads.strikinglycdn.com/files/6d8095d0-6ed2-4135-9615-72f840ecbfe5/64171697964.pdf
    • http://metorudadoz.rf.gd/kumadodularajazagonajejez.pdf
    • https://uploads.strikinglycdn.com/files/222e28af-e9a8-4ca1-aeb1-b688691f1689/how_much_does_it_cost_to_replace_a_furnace_in_a_mobile_home.pdf
    • http://vowajug.rf.gd/watixivoganifelumugajo.pdf
    • https://uploads.strikinglycdn.com/files/9f3fc56d-1a97-47d1-910c-dd420149f5f4/50712216436.pdf
    • https://uploads.strikinglycdn.com/files/7a365052-6eb6-4d90-bea6-257b4ad4048a/how_do_i_reset_my_rca_voyager_tablet.pdf
    • https://uploads.strikinglycdn.com/files/5bc36051-e6e8-4b01-bb42-19411785538b/how_to_resign_as_trustee_of_an_irrevocable_trust.pdf
    • https://uploads.strikinglycdn.com/files/52e72d89-54ff-42b7-8c43-6cd408c32464/dd_miniatures_alternatives.pdf
    • https://uploads.strikinglycdn.com/files/1e294338-7c45-49c0-a23c-887db44d9ce1/gudumejutodagolosed.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f338.bin
8574919c7c8a9f024103958ce015253c5a24b8e646cdb5f787658918713f2b2b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF338 3080 bytes
font_01_sfnt_off0000fe40.bin
eba8e1c08334d954ac5e564f827f41530616695eaa870ac5d93527cf922d7553		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE40 5028 bytes
font_02_sfnt_off00010f69.bin
f51d4be5b31bbaf6c575ce1c51df392075dc767b62cbef96b3b294727a29ec3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10F69 11620 bytes
font_03_sfnt_off0001363f.bin
3e97e43a358aaf7e1d316a718fb2edeabc36751fc2ce4f892eaccf59fd742e71		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1363F 16304 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.