Malicious PDF — malware analysis report

Static analysis result for SHA-256 db3009308c2c82c5…

MALICIOUS

PDF

78.2 KB Created: 2021-05-07 10:46:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1d48db8519bef8ebbc1a70dc3598824f SHA-1: 2823b49db02f8a1795164d83232360d9cde135f4 SHA-256: db3009308c2c82c56d6f37bfcd4e9867c72d3aee038c37b18ebadca6965cc092
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains an embedded URI pointing to a suspicious domain, likely intended to host phishing content or a malicious payload. ClamAV detection and ML classification strongly indicate malicious intent. While no scripts were directly extracted, the PDF structure and embedded URLs suggest a phishing or malware distribution attempt, likely initiated via spearphishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=what+is+a+guaranteed+viable+curriculum
    • http://rezuwalep.iblogger.org/water_soluble_fertilizers_for_fertigation.pdf
    • http://theplafond.xyz/fable_3_activation_key_unlock_request_code72pgt.pdf
    • http://zarepaputome.iblogger.org/47013204994.pdf
    • http://zafuwozemupojaw.22web.org/the_maze_runner_3_full_movie_download_filmyzilla.pdf
    • http://skidki-day.site/one_night_at_the_call_centre_ebook_free_downloadowkqs.pdf
    • http://prosale.company/hell_inc._imp_theme_park_tycoon_2ezyna.pdf
    • http://premial.su/dilolamebolemagutvrwh.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/6d7aad0b-dea1-461c-a995-7a4dc1a94c11/que_dias_son_feriados_en_julio_2020_peru.pdf
    • http://zijuboniwopaxi.epizy.com/52058182011.pdf
    • http://romamosok.rf.gd/nuvoseselonu.pdf
    • https://uploads.strikinglycdn.com/files/7e50f3d9-e9e0-4fee-bbad-004f7e8b4cf5/halo_the_fall_of_reach_movie_download.pdf
    • http://gunitolowed.rf.gd/telovarinurowesilo.pdf
    • https://71e5fc8e-cc9a-4633-96c3-2c70acd464d0.filesusr.com/ugd/f08e01_f888339f080542dca0329de907f12144.pdf?index=true
    • https://uploads.strikinglycdn.com/files/f1d66855-3b2c-4c1c-8b04-4447bad3d3d9/how_to_cut_stone_saw.pdf
    • https://cd65756b-a9c7-4cca-9498-1747a6459195.filesusr.com/ugd/05eb20_b35912d9ac034bf382e2118902cabca1.pdf?index=true
    • http://ponuwisakaso.rf.gd/12796430114.pdf
    • https://uploads.strikinglycdn.com/files/03b7854d-0766-4e78-8ebe-e2ee8bc6336e/it_manager_salary_in_uae.pdf
    • http://jatufivo.rf.gd/base_de_datos_en_excel_con_archivos.pdf
    • https://uploads.strikinglycdn.com/files/c2417813-9111-47c4-960e-f26b4dd301a6/74130162146.pdf
    • http://kejarajavamoge.epizy.com/daxujotom.pdf
    • https://uploads.strikinglycdn.com/files/10d88e08-c067-4a74-82ec-7ca916829560/3509888674.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e69f.bin
373b7855f37f8891b2806bae67d97a3d6f7620d7f0637569ef0f5e95a6a0327e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE69F 5336 bytes
font_01_sfnt_off0000f89e.bin
8e0ea936053c7f1ba6a2e13321b2f237bb22d32c6fc866c10195ea154c7f47c6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF89E 10744 bytes
font_02_sfnt_off00011d10.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11D10 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.