Malicious PDF — malware analysis report

Static analysis result for SHA-256 d97f2dc664afb91f…

MALICIOUS

PDF

97.0 KB Created: 2021-03-15 22:51:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 605f48e8e93b469f2d3f4b89cbb00dbe SHA-1: eb5cc864b170b5bf30075b4c6b73a5af719d48e8 SHA-256: d97f2dc664afb91f90c06911279465650a5b281fd492283a78665320542fbb17
104 Risk Score

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript and an external URI pointing to a suspicious domain, indicating an attempt to deliver a malicious payload. ClamAV detection and ML classification strongly suggest malicious intent, likely a phishing lure disguised as a product manual to trick users into downloading further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=bose+color+2+manual
    • https://static.s123-cdn-static.com/uploads/4413016/normal_5fde35991c3d5.pdf
    • http://worldworkbook.com/how_to_measure_the_interior_angles_of_a_polygon3h6tl.pdf
    • https://cdn.sqhk.co/nepajenine/jh3BjbV/56497162044.pdf
    • https://cdn.sqhk.co/jonilinenuvo/zPOggei/download_game_warlords_2_rise_of_demons.pdf
    • https://cdn-cms.f-static.net/uploads/4469106/normal_5fd1e464ec872.pdf
    • https://cdn-cms.f-static.net/uploads/4477156/normal_60254a61c1837.pdf
    • https://static.s123-cdn-static.com/uploads/4468836/normal_5fcd37d76555e.pdf
    • http://operationhomeplate.com/are_timex_watches_worth_anythingxox98.pdf
    • http://adanakebap.org/widasuduvorapg8zd.pdf
    • http://nububezobuto.22web.org/difference_between_autotrophic_and_heterotrophic_nutrition.pdf
    • http://potolkilife.ru/91237374762yibkf.pdf
    • http://propovar.ru/gilovifiguzetq5yae.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/tasufagijaremo/solving_equations_and_inequalities_worksheet.pdf
    • https://s3.amazonaws.com/wexoteluwag/gogojewokojotoma.pdf
    • http://favigawesuwevo.rf.gd/browser_support_proxy_android.pdf
    • https://8a6b9437-e7f2-49d7-8c24-351b272aa67a.filesusr.com/ugd/b18e4d_997c5ea36bd848a5a29203d63f8e5026.pdf?index=true
    • https://7648721b-06f4-4917-9c2a-921156fbbd07.filesusr.com/ugd/a7266c_e3543d99a43f4719bbbc3f3cc2dc8efe.pdf?index=true
    • https://5053e88e-9e18-4719-890c-32a1cca0295d.filesusr.com/ugd/411503_b891b4f71e15400a9f4d3141a89feb66.pdf?index=true
    • http://mowesedapi.epizy.com/vadenuwig.pdf
    • https://627f215e-41ba-4aa4-9906-5f9f9d117739.filesusr.com/ugd/8ab72e_afe6bf88edf9492d8c73d54405026f87.pdf?index=true
    • https://s3.amazonaws.com/wifiduxezo/snapper_rocks_surf_report.pdf
    • https://f89b8795-a90f-4359-81e0-6309601a98d9.filesusr.com/ugd/8e7730_6ec09141562548ad9c95e6f9d97413e0.pdf?index=true
    • http://xifonefoje.epizy.com/environment_agency_river_thames_guide.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e71c.bin
a0b2729621f47599c7ab57345d4d777c1894716ac7247de2fd3fc155f5d23716		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE71C 27184 bytes
font_01_sfnt_off00013bd9.bin
df15127f2a61bd72bd2a9e4f6856944cd88ddbf85d44e7bb7418141d293dbfdc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13BD9 5124 bytes
font_02_sfnt_off00014d2b.bin
0e1eaae959be9595fbfa182e396658b98f0fea7ca9db1ff2b804ec2b0f1c7b74		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14D2B 12808 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.