Malicious PDF — malware analysis report

Static analysis result for SHA-256 d6ccd805d11d5325…

MALICIOUS

PDF

68.9 KB Created: 2020-11-14 21:50:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: aff11c20e887eb829109c3507e38c189 SHA-1: 18d0e31e421c3329d439feb3a7179ca814c0a749 SHA-256: d6ccd805d11d5325e6ecb8fac58724e39d478574948a8e1fbc0d11f50c0e5886
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. The embedded URL points to a suspicious domain, likely used for phishing or malware distribution. While no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/123?utm_term=star+wars+jedi+fallen+order+cast+and+crew
    • https://cdn-cms.f-static.net/uploads/4369768/normal_5faf74bc82210.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/simujix/oracle_mission_statement.pdf
    • https://uploads.strikinglycdn.com/files/98d69654-c19d-4d2c-b461-f622114721c3/walmart_weaknesses_2018.pdf
    • https://uploads.strikinglycdn.com/files/9c05eacd-8097-4078-862f-c2f69f3dd67d/lauren_clark_davita.pdf
    • https://s3.amazonaws.com/wunojipu/52654097549.pdf
    • https://s3.amazonaws.com/bokofapig/how_to_convert_radians_to_degrees_c.pdf
    • https://uploads.strikinglycdn.com/files/caede6ae-c173-40b7-ae2e-b1c0259f7a48/development_across_life_span_8th_edition.pdf
    • https://uploads.strikinglycdn.com/files/f64ccd69-e164-4a15-8e3f-79a3087cdc26/vizio_e_series_60_manual.pdf
    • https://s3.amazonaws.com/vojapu/nyfl_football_las_vegas.pdf
    • https://uploads.strikinglycdn.com/files/56c64f7b-8122-427c-88be-e4e33ff54f73/mogofebaxerawujulevikaw.pdf
    • https://s3.amazonaws.com/rijedifatufod/mudisopubigowov.pdf
    • https://s3.amazonaws.com/loxopudizus/topik_guide_korean.pdf
    • https://s3.amazonaws.com/suzixegazunow/dolphin_games_unblocked.pdf
    • https://s3.amazonaws.com/limepusotanal/pelegesufexemomeka.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d085.bin
13fa078c2cf0e735f4e9d53b90dbc19776124b217171e171ed36bdb9517eef83		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD085 5284 bytes
font_01_sfnt_off0000e2a2.bin
4f491f4be3aabee415321295ecf14be7591cdc762be35ea8c93ceaa529e23041		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE2A2 10524 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.