Malicious PDF — malware analysis report

Static analysis result for SHA-256 d6d82a7717a25fd8…

MALICIOUS

PDF

110.3 KB Created: 2021-03-23 17:25:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: e01fc8b8881f2179694cd59dee8c4e46 SHA-1: b2c1cec54239d1cabd7aaa4abd5190460d9601af SHA-256: d6d82a7717a25fd8624fc6fa128dd5e6e9a942be78965b86ca8c623dfb441a62
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/123?utm_term=start+bootstrap+ecommerce+template PDF link annotation
    • http://fazejajogavu.medianewsonline.com/zezikugepubewuwimob.pdfIn PDF document text
    • https://cdn.sqhk.co/fixiwuwukufi/gihgBgh/80947914822.pdfIn PDF document text
    • http://liwurivosopap.medianewsonline.com/24400162309.pdfIn PDF document text
    • http://mufutekuson.getenjoyment.net/muwasubaw.pdfIn PDF document text
    • http://nemosixumeki.mypressonline.com/dunkin_donuts_matcha_latte_calories.pdfIn PDF document text
    • https://cdn.sqhk.co/jonilinenuvo/gfgeXgj/alien_shooter_td_mod_apk_free_download.pdfIn PDF document text
    • http://gejulavofanutar.mygamesonline.org/type_b_blood_diet_food_list.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/lezopobigeza/62827472919.pdfIn PDF document text
    • https://s3.amazonaws.com/forupokisip/35578968930.pdfIn PDF document text
    • https://s3.amazonaws.com/jinabisura/multiplying_mixed_fractions_worksheets_with_answers.pdfIn PDF document text
    • http://mesobuze.epizy.com/test_graphics_card_performance_mac.pdfIn PDF document text
    • https://s3.amazonaws.com/zosevid/ego-t_3200mah_rechargeable_variable_voltage_battery.pdfIn PDF document text
    • http://vuwepowav.epizy.com/blank_tee_shirt_template_free.pdfIn PDF document text
    • https://s3.amazonaws.com/gajakelegeza/ambient_weather_station_ws-_2902_manual.pdfIn PDF document text
    • http://vekejuf.atwebpages.com/monewasixelajarixosir.pdfIn PDF document text
    • https://s3.amazonaws.com/xalexojaxipud/source_2_engine.pdfIn PDF document text
    • https://s3.amazonaws.com/lorifumofelu/ap_style_guide_phone_numbers.pdfIn PDF document text
    • http://medelomozukomav.epizy.com/portable_android_charger_walmart.pdfIn PDF document text
    • http://peronilekovo.rf.gd/beery_vmi_sample_report.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001741b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1741B 5324 bytes
SHA-256: 1153a51245c376e340fd4bb972133c48a9dd95e7cf528f2c9b5421a1cf7dc876
font_01_sfnt_off00018617.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18617 11104 bytes
SHA-256: 0d67ddb327f51bd0d509050d08f8cae28f5ba50f6c0644d6ae44fde23029631c

Open this report in the interactive analyzer, or submit your own file for analysis.