Malicious PDF — malware analysis report

Static analysis result for SHA-256 d5ebfe5a32c72be9…

MALICIOUS

PDF

121.7 KB Created: 2021-04-05 11:27:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a045f2b1a44bd2127576e4d331ff47d9 SHA-1: 9112d4009d2519928c46517f2efcb0aea7cab7a8 SHA-256: d5ebfe5a32c72be9b79701041e4cfbaf362fa5675500bf019858f14379bfd30d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI that redirects to a suspicious domain, likely as part of a phishing or malware distribution scheme. The ML classifier and ClamAV detection strongly indicate malicious intent. Although no scripts were directly extracted, the presence of external URIs and the nature of the PDF content suggest it's designed to trick users into visiting a malicious site, potentially for credential harvesting or further payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=kuwo+music+apk+old+version
    • http://gagimubu.mywebcommunity.org/jozogedofar.pdf
    • http://foxareb.22web.org/76325969274.pdf
    • http://nogafadak.iblogger.org/agent_vinod_full_movie_720p.pdf
    • http://wegijezunulej.22web.org/7066680095.pdf
    • http://kaboliwup.mypressonline.com/how_many_calories_does_a_15_year_old_need_to_lose_weight.pdf
    • http://letabumo.getenjoyment.net/belajar_bahasa_korea_dasar_hangul.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/4705487c-4757-4c9d-aceb-f319291ff6d9/how_to_best_listen_to_music.pdf
    • https://uploads.strikinglycdn.com/files/ed93764f-765e-444d-b5be-ee3268980600/84658805808.pdf
    • http://venuxekokufago.rf.gd/big_biceps_workout_routine.pdf
    • https://s3.amazonaws.com/fumiposamisur/nice_guidelines_neonatal_jaundice.pdf
    • https://s3.amazonaws.com/leteraxewe/64297674449.pdf
    • https://uploads.strikinglycdn.com/files/156a0975-9ef6-495f-a51a-9ef39297b249/the_devil_wears_prada_full_movie_free_123movies.pdf
    • http://pulutugorivexek.atwebpages.com/att_-_crl32102_dect_6.0_expandable_cordless_phone_with_digital_answering_system.pdf
    • http://sikadakomog.epizy.com/87201527582.pdf
    • https://s3.amazonaws.com/loneminovu/metakal.pdf
    • https://uploads.strikinglycdn.com/files/3c4ed70a-af74-4dd2-acfa-9e56504ea4e9/usps_service_type_code_list.pdf
    • https://s3.amazonaws.com/zoromexemuzid/biochemical_tests_of_bacteria.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee5b.bin
ace95f488102c36324288b1095f7b84cebe35559864d3087ef0ab4328e78d7e8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE5B 42284 bytes
font_01_sfnt_off00017032.bin
095cb5d984e3cf0925284d9fef8a3e73e7b99e20027f484f1216e3ed0a36c412		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17032 5204 bytes
font_02_sfnt_off000181d6.bin
125a84ec6eff4bf05a8f9a21e9c3994cf4ad1f80e25456101235ca3ad4515f7c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x181D6 2108 bytes
font_03_sfnt_off00018ba5.bin
883d9e33b545f7f91774f3849950fd62c4f002e7a09b6cc8fb8fc76a9ef854d3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18BA5 11132 bytes
font_04_sfnt_off0001b1c7.bin
fa6ac51f4f19bd2ecdd5365a7a4f6f75b9b01aef9c89d2fca7ca663613fe1e65		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1B1C7 16264 bytes
font_05_sfnt_off0001c768.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1C768 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.