Malicious PDF — malware analysis report

Static analysis result for SHA-256 d7cef63f3e7e67be…

MALICIOUS

PDF

78.5 KB Created: 2021-03-09 14:30:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f1c907e9178e9439ec87c49d6be94a45 SHA-1: b063e2741d69ff020db890ebd76d0050b33832f8 SHA-256: d7cef63f3e7e67bec4aec06718437f34ea60f0dca79068ad623e6b30a8b0734f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL `https://pelibifir.ru/award?keyword=difference+between+windows+7+and+windows+10+pdf` suggests a phishing lure, aiming to trick users into visiting a potentially harmful site. While no scripts were explicitly extracted, the PDF structure and the presence of external URIs are common in phishing documents.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/award?keyword=difference+between+windows+7+and+windows+10+pdf
    • http://sovolox.getenjoyment.net/luvejisamexu.pdf
    • http://zexaribamemavi.sportsontheweb.net/xajakutabudivaki.pdf
    • http://rubolanir.mypressonline.com/.pdf
    • http://about-fb-support.com/pittsburgh_1.5_ton_racing_jack_reviewm8cjy.pdf
    • http://prizinsta24.site/amazon_kindle_4_specsbokpx.pdf
    • http://podeves.xyz/can_alexa_control_my_bluetooth_speakerqatvd.pdf
    • http://julivojurukumu.sportsontheweb.net/how_to_close_ntuser.dat_file.pdf
    • http://worelimupuvefam.mywebcommunity.org/why_does_my_wireless_headset_keep_disconnecting.pdf
    • http://fevinoreniwelik.sportsontheweb.net/jpmorgan_chase_bank_court_orders_and_levies_department.pdf
    • http://kulotufiw.mypressonline.com/47016269139.pdf
    • http://lulopoboxefon.scienceontheweb.net/snapper_28_inch_riding_mower_bagger.pdf
    • http://tewatag.medianewsonline.com/gevufetofezeguvimugew.pdf
    • http://kevarusakoko.mypressonline.com/gibinusopuwexudiwozava.pdf
    • http://kumululurug.scienceontheweb.net/ashton_irwin_sister_age.pdf
    • http://takaweri.mywebcommunity.org/pebarevunusevabilubu.pdf
    • http://bufibinokurun.scienceontheweb.net/womarom.pdf
    • http://prizinsta365.website/mojalzgcul.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://sidepojedava.myartsonline.com/12714423984.pdf
    • http://fararisujis.myartsonline.com/94891786364.pdf
    • https://s3.amazonaws.com/bitajemisajoz/codycross_answers_group_238_puzzle_3.pdf
    • https://s3.amazonaws.com/gupojakami/american_guidelines_for_diabetes_mellitus.pdf
    • https://s3.amazonaws.com/fajujiju/watford_vs_arsenal_highlights.pdf
    • http://nibemodida.myartsonline.com/4936406126.pdf
    • http://rixuroruwe.myartsonline.com/convective_heat_and_mass_transfer_3rd_edition_solution_manual.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef3e.bin
220099f16e83901f87d1d35a27929c1cb1ef1b6943aa4ebb03ae04d70ea06779		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF3E 5624 bytes
font_01_sfnt_off0001028e.bin
750167b472947a432252a7f7b079130f1c16860c5d2be32761d7eec719da98e4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1028E 12204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.