Malicious PDF — malware analysis report

Static analysis result for SHA-256 db6c5c08fd2ce29c…

MALICIOUS

PDF

82.2 KB Created: 2021-03-24 18:09:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 006cef2ad33a73fb39f9bc9bc7aa6082 SHA-1: efe9c27a0f8811b65af49a69853f9fb5935e1bb3 SHA-256: db6c5c08fd2ce29cba493e84e83f6a7ca295fb28a0346ef66d89823fec1d99ba
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, indicating a high probability of malicious intent. It contains an external URI pointing to a suspicious domain, likely intended to deliver a malicious payload or redirect the user to a phishing site. The document body, though heavily obfuscated, suggests a lure related to 'secretory tissue in plants pdf'. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9954

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/award?keyword=secretory+tissue+in+plants+pdf
    • https://posilopawirina.weebly.com/uploads/1/3/4/3/134353572/zadipajutuvo_zekudokakaradej.pdf
    • https://cdn-cms.f-static.net/uploads/4367273/normal_6014853d03104.pdf
    • https://cdn-cms.f-static.net/uploads/4369912/normal_600f13fd150b0.pdf
    • https://tatelemu.weebly.com/uploads/1/3/1/1/131164239/dalipaget-gidemugojaw.pdf
    • https://cdn.sqhk.co/nozesinipi/Chcgghd/zizukugilupugozidarirog.pdf
    • http://tuguxanofa.iblogger.org/bcg_matrix_excel_template.pdf
    • https://cdn-cms.f-static.net/uploads/4368750/normal_5fd8f927ef3ab.pdf
    • https://cdn.sqhk.co/jutusaxibu/ghgjhal/duzedigodomaravidakexu.pdf
    • https://cdn.sqhk.co/sabepakofo/giF4Wha/sago_mini_planes_apk_download.pdf
    • https://cdn-cms.f-static.net/uploads/4416131/normal_5fda73eac3d06.pdf
    • https://cdn.sqhk.co/lojiwoxaz/7ggjinb/skyblock_ip_address_minecraft_pe.pdf
    • https://leduzurukidep.weebly.com/uploads/1/3/4/8/134858842/degobiwogoxa.pdf
    • https://cdn.sqhk.co/ketofebem/hf8jaJh/99948525303.pdf
    • https://jizufozerujit.weebly.com/uploads/1/3/4/3/134343201/nogez.pdf
    • https://wepusiviji.weebly.com/uploads/1/3/4/6/134661614/1f5f5ce796.pdf
    • https://cdn-cms.f-static.net/uploads/4402940/normal_6041406d96fb1.pdf
    • http://gemosugobez.22web.org/chameleon_color_adapting_lwp_apk_pro.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/6b903ed9-fc16-4208-86e9-12eb677a94fd/rinnai_ruc98in_indoor.pdf
    • http://xilidufagipap.rf.gd/35365233252.pdf
    • https://uploads.strikinglycdn.com/files/90e2816a-fad0-4989-9ab5-41512e7d50a2/45146053102.pdf
    • https://uploads.strikinglycdn.com/files/cc504d58-b7b5-40e7-b194-6279302fa628/troy_bilt_storm_2410_spark_plug.pdf
    • http://gebefamudusefo.epizy.com/30420888144.pdf
    • https://s3.amazonaws.com/tufujifinobiro/what_is_unanimous_consent_agreement_in_senate.pdf
    • http://tabizamasozelo.epizy.com/zunotux.pdf
    • https://s3.amazonaws.com/rolefosiju/find_duplicate_rows_in_excel_sheet.pdf
    • https://s3.amazonaws.com/mogedozara/73431788360.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f720.bin
ad2faf44d4601fa9c69e90af2614894318f367e167025f024a99eab55aa6c08e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF720 5236 bytes
font_01_sfnt_off000108f6.bin
cca55d7e7a578ba311714c824887efbc95a26868257c6b3bea686e242b8d5598		 pdf-font-stream PDF embedded font (sfnt) at offset 0x108F6 10488 bytes
font_02_sfnt_off00012ce6.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12CE6 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.