Malicious PDF — malware analysis report

Static analysis result for SHA-256 d635080698b9fcf0…

MALICIOUS

PDF

76.4 KB Created: 2021-03-22 00:52:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: eab4716d29cc8c07b648958c4174fa3b SHA-1: 5ecf78d39b43c1da2b4a4009992301e967df1bf2 SHA-256: d635080698b9fcf0ed3511deebf1a4ad43c017aa18cf8511ed56f95f3874d49f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The embedded URL points to a suspicious domain, suggesting the document is a lure for phishing or malware delivery. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of common phishing techniques.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wix?keyword=the+princess+bride+study+guide+questions+and+answers
    • https://cdn.sqhk.co/nosimasiv/iiOjhif/61221282170.pdf
    • http://tirevuvezig.22web.org/seasonal_round_archaeology_definition.pdf
    • http://sevazumemozoli.22web.org/73257336601.pdf
    • https://jitebemaduk.weebly.com/uploads/1/3/4/6/134692965/4745b23d5c72c.pdf
    • http://ig-copyrightnotice.com/basic_elements_of_design_value_examples31nty.pdf
    • https://gefobivuvevu.weebly.com/uploads/1/3/1/3/131380717/5bbf432f82b.pdf
    • http://repair-planshetov.ru/830970050174502q.pdf
    • https://cdn.sqhk.co/zekuxemelop/pIgchaw/my_talking_tom_mod_apk_download_free.pdf
    • https://jarupaxalimex.weebly.com/uploads/1/3/5/3/135324443/vafemutuvekuxufinuv.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://bibikefogive.epizy.com/84407941445.pdf
    • https://e809654a-a95b-4dbc-a338-24085255a2f8.filesusr.com/ugd/1b6cec_a7b8f446bb8349a78142b4d34199f389.pdf?index=true
    • https://3f5765b5-411c-4b28-96d1-a1e3b219bcee.filesusr.com/ugd/ca847e_d0757487b98343b788be0602fee4c119.pdf?index=true
    • http://lumaxixi.epizy.com/beats_by_dr._dre_solo3_wireless_on-ear_headphones_review.pdf
    • http://fubolorira.epizy.com/math_riddle_answers_search.pdf
    • https://3437305d-a3f4-4f94-9a63-846dd410f5be.filesusr.com/ugd/ffe76b_1b1a8b9dcfdc4513a43b65ae46e73c4a.pdf?index=true
    • http://ninanupazazudad.rf.gd/princess_diaries_2_full_movie_with_english_subtitles_watch_online.pdf
    • http://bufiziwo.rf.gd/34536935085.pdf
    • http://revuzinolijafit.epizy.com/the_body_language_of_love_free_download.pdf
    • http://povokufav.epizy.com/what_size_file_for_.325_stihl_chain.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec50.bin
ba64adc68cadce29085626e5b5b1430cdb131647994b19edbc502ca7ecb48894
pdf-font-stream PDF embedded font (sfnt) at offset 0xEC50 5712 bytes
font_01_sfnt_off0000ffba.bin
a5e3b54049c799f19ee51a4fc361f054e91eb16fd33a37dd3dd95d0b4828700b
pdf-font-stream PDF embedded font (sfnt) at offset 0xFFBA 10744 bytes