Malicious PDF — malware analysis report

Static analysis result for SHA-256 dbfd223b8d47540d…

MALICIOUS

PDF

81.2 KB Created: 2021-03-19 12:04:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d84a74f3384bfe6a7f1b4c01094c320c SHA-1: ba83142f486d6824ee0c8caa09a4bf33a64c9b21 SHA-256: dbfd223b8d47540d2a4b74fc9d158324753c008e99a93a7d235a9ba106e7f5f9
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. The document body, though heavily obfuscated, appears to be a lure related to crop types, suggesting a social engineering tactic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9961

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/wix?keyword=what+are+the+two+types+of+crops
    • https://cdn.sqhk.co/karapenakozi/KGLuigM/bloons_td_battles_10x_mod.pdf
    • https://cdn.sqhk.co/gepeduvo/QigT2XC/77139704680.pdf
    • https://cdn.sqhk.co/lonubugogere/ifxgep3/76445494863.pdf
    • https://static.s123-cdn-static.com/uploads/4531626/normal_6004e95279e5c.pdf
    • http://wamipivifubape.sportsontheweb.net/rupos.pdf
    • https://cdn-cms.f-static.net/uploads/4379385/normal_604d19b016461.pdf
    • https://static.s123-cdn-static.com/uploads/4465010/normal_5feb94a27edf4.pdf
    • https://cdn.sqhk.co/fagojefavap/hV8hihb/modern_warfare_3_xbox_one_online.pdf
    • https://cdn-cms.f-static.net/uploads/4376870/normal_6042457b03b6e.pdf
    • https://cdn.sqhk.co/zejejofe/OhhQB7B/go_launcher_prime_remove_ads_apk_download.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/zerejibixupav/7288924752.pdf
    • https://uploads.strikinglycdn.com/files/4a54a3bd-1ce1-400b-a08e-255c7ecb420e/descargar_concordancia_biblia_gratis_para_iphone.pdf
    • https://uploads.strikinglycdn.com/files/827d5652-fe31-4164-bbd2-117348c257b2/precio_de_pedalera_digitech_rp255.pdf
    • https://s3.amazonaws.com/wonumafubij/dnd_5e_scholar_class.pdf
    • https://uploads.strikinglycdn.com/files/d642148f-0abc-4d8b-be1e-c31fe35af865/how_to_come_up_with_a_title_for_a_romance_novel.pdf
    • https://uploads.strikinglycdn.com/files/d1f614d6-97a0-40c0-a4ed-1f612fb516f7/82806628153.pdf
    • https://uploads.strikinglycdn.com/files/76b351a2-1304-4aae-bb10-4131b97cd6c9/youtube_robert_kiyosaki_the_business_of_the_21st_century.pdf
    • https://s3.amazonaws.com/dudujopixejikug/classification_of_antibiotics_with_examples.pdf
    • https://uploads.strikinglycdn.com/files/35806ec7-473b-4f43-856b-9e0979b44f1d/jiwogi.pdf
    • http://wepogevadapafa.atwebpages.com/consulta_de_procesos_judiciales_rama_judicial_de_colombia_por_cedula.pdf
    • https://uploads.strikinglycdn.com/files/048d71f1-cf61-45e1-a748-e0d6c679e71e/moultrie_game_camera_user_manual.pdf
    • https://s3.amazonaws.com/xeruxaxer/aeroplane_punjabi_song_video.pdf
    • https://uploads.strikinglycdn.com/files/9862f6bc-e38c-45a5-9f39-b1f94a38215c/11362264343.pdf
    • https://s3.amazonaws.com/mejobu/nara_attractions_japan_guide.pdf
    • https://uploads.strikinglycdn.com/files/0f3f4fa3-c101-4cbb-a2e1-0c0f33549a61/sirisijixuwawumofaw.pdf
    • https://uploads.strikinglycdn.com/files/e03966d4-50fa-4d3a-acf7-f91c0983705a/python_video_game_learning.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fd6a.bin
66132524d331df96fd25f4451badedf2418d3fb286cf74085bafad37857903b0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD6A 5276 bytes
font_01_sfnt_off00010f7b.bin
ff5776a71929645ba4f4a9c9d660fb2ed4af4e8590c2caf09c572f32bd227cec		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10F7B 11524 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.