Malicious PDF — malware analysis report

Static analysis result for SHA-256 d7cde20dac21ab15…

MALICIOUS

PDF

70.8 KB Created: 2021-05-13 18:50:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dd6c761a06e7031931903635a0a5fd4b SHA-1: 597169623095399b0bf663222a940a642d186603 SHA-256: d7cde20dac21ab156dd9307d653d1cdaaf0f9c2ebf206f416896dc57752b3e2c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as a malicious PDF by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of multiple embedded URLs, many pointing to suspicious PDF files hosted on compromised websites, suggests a phishing or credential harvesting attempt. The document body, though truncated and obfuscated, contains metadata that could be part of a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://iamluno.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608b0af93ca5b---jemusukur.pdf
    • https://www.revistadefiesta.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606ca02e2c9f8---fegumodujonekesoradedoj.pdf
    • http://www.aluvascientific.com/UserFiles/file/828702911.pdf
    • https://qamarapps.com/wp-content/plugins/formcraft/file-upload/server/content/files/160828b81ee672---zibifavokowon.pdf
    • https://snabavto.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608c4c847930b---lunofexenakupivuvijapig.pdf
    • http://www.zulfugar.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1609681490cb56---didifezuniguguxalewujojul.pdf
    • https://unicornproduction.gr/wp-content/plugins/super-forms/uploads/php/files/fefdcd5e611d2840a628c712c67520be/8097725948.pdf
    • https://daleplumbinginc.com/wp-content/plugins/super-forms/uploads/php/files/419c34c97cc316ba23ec14995d2f22e1/4011442432.pdf
    • http://caacoding.net/wp-content/plugins/formcraft/file-upload/server/content/files/1609a9fd158a16---zuwegejibasotixukemapipox.pdf
    • https://www.alpha-dynamics.gr/wp-content/plugins/formcraft/file-upload/server/content/files/16075272ee548a---vejumerufotivazawopajax.pdf
    • http://www.training4thefuture.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1607f868502dc8---73761586614.pdf
    • https://ipcare.nl/wp-content/plugins/super-forms/uploads/php/files/f938hu8c46e94ku339gjr6sjs2/lisavofetozu.pdf
    • http://www.ponderosafestival.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071b490ca6e3---98334529997.pdf
    • https://mithermomix.com.mx/wp-content/plugins/super-forms/uploads/php/files/6617954bd9128f2230b187969e7ec56e/vasixazafak.pdf
    • https://canadianrelocation.net/wp-content/plugins/formcraft/file-upload/server/content/files/1606f4161e0877---83462542713.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/skout/mBVl/~3/LPIa9PGmDLg/uplcv?utm_term=flowering+night+violin+sheet+music
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d84d.bin
9dd8d34858fd18315f43861d9638c69a691163da5948ac23e0682325bd333245		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD84D 5108 bytes
font_01_sfnt_off0000e9a6.bin
1c334e568bd6627d7ea6d6e24a75042aa11fe8b6f7342b5d3d932438aa09c2dc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9A6 10936 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.