Malicious PDF — malware analysis report

Static analysis result for SHA-256 d81a44ae1539bf5a…

MALICIOUS

PDF

90.6 KB Created: 2021-03-20 17:52:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: a8fcf2390a5088826ee0db6647598707 SHA-1: 701d4e4fd2b6cc7a93c69c58edc125c4ee841b09 SHA-256: d81a44ae1539bf5aa850bb5d276e44f67c9c38c92912951db2bcc4bf4b55ccd2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wix?keyword=pubg+mobile+mod+apk+hack+download+0.19.0 PDF link annotation
    • https://cdn.sqhk.co/lafixafif/Xhhja83/26851899693.pdfIn PDF document text
    • http://vijevejumozugim.sportsontheweb.net/sudafositulize.pdfIn PDF document text
    • https://cdn.sqhk.co/rojisixel/W0ja798/4475375824.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://lojibovel.myartsonline.com/cashew_nut_production.pdfIn PDF document text
    • https://78f5967e-1348-44d0-b43d-4fba71d4c3e7.filesusr.com/ugd/a94f6a_9bb89b7b7fc74a7e820f5524747852a8.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/pilazi/acquittal_report_meaning.pdfIn PDF document text
    • http://zejibanunepi.myartsonline.com/panuje.pdfIn PDF document text
    • https://6b137298-3864-41c5-aaa3-11744000c3c2.filesusr.com/ugd/b916f4_a0f92b404b8d43d28b81a37b444fdc10.pdf?index=trueIn PDF document text
    • http://rofarodet.rf.gd/assignment_abroad.pdfIn PDF document text
    • https://d71fc03c-aea6-48f7-a990-8afffb22108d.filesusr.com/ugd/3de8a6_4a963d7b9c6040dcb98d2d193a44bcdd.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/marimejerebo/8052490968.pdfIn PDF document text
    • http://wikukodukoja.onlinewebshop.net/ballot_paper_2020.pdfIn PDF document text
    • https://4465b75e-e642-4f53-8c89-e22f0b9d4994.filesusr.com/ugd/ecd213_2721947d8ebb417caac5375cea884daa.pdf?index=trueIn PDF document text
    • http://matogojetize.rf.gd/telugu_new_movies_tamil_rockers._com.pdfIn PDF document text
    • https://a815f367-2516-4b88-9496-eed07d5c1eb7.filesusr.com/ugd/665c20_b70bcc8c57684b7299894a49c654b4ec.pdf?index=trueIn PDF document text
    • https://5fa60de5-32ab-41ac-ba65-77330e21e623.filesusr.com/ugd/2e16aa_186e77531f784afdb51f219e17dab8c3.pdf?index=trueIn PDF document text
    • http://gozuxinub.epizy.com/abs_plastic_sheet_1_4_thick.pdfIn PDF document text
    • https://s3.amazonaws.com/temujonuwu/boiler_control_system_engineering.pdfIn PDF document text
    • https://s3.amazonaws.com/vekodupiwarobi/tosijanoxovenobozu.pdfIn PDF document text
    • https://s3.amazonaws.com/werowibovezoje/minogibolomijute.pdfIn PDF document text
    • http://tizeruxabono.onlinewebshop.net/clinical_laboratory_report_format.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f61c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF61C 5892 bytes
SHA-256: 69d595343cc4cfc4009f53e55e8f534768ed85f81bf8f077ecbb71463e91ebca
font_01_sfnt_off00010a19.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A19 3928 bytes
SHA-256: 9f0e641fd2357051dee898db79e25f4623cfe2a6b6d01fc00a25e3f2af88963a
font_02_sfnt_off0001195d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1195D 11720 bytes
SHA-256: 2252725ed8d3f25bca76a604ec8512f6bf8c6656afb937d11f65b0702fbc01e1
font_03_sfnt_off00014173.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14173 17216 bytes
SHA-256: f534564025b51d2f658fc52075b1ed282d1b4712a19b620bcdf80fdf1753f43d

Open this report in the interactive analyzer, or submit your own file for analysis.