Malicious PDF — malware analysis report

Static analysis result for SHA-256 dbfe8cc863dbd5ff…

MALICIOUS

PDF

77.6 KB Created: 2021-03-16 06:01:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2dabfeab7d532177375932eddca3c1ce SHA-1: ed2964e89b8f54afbe48dcc0b9057397dbcf8ddf SHA-256: dbfe8cc863dbd5ff4aede7b62afc251578b7f9e65ba5f7488be8caeb5ec02d06
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, indicating a phishing or trojan threat. It contains an embedded URL pointing to a suspicious domain, likely intended to host a malicious payload or redirect the user to a phishing site. The document body, though heavily obfuscated, suggests a lure related to 'Clocks piano sheet music easy', aiming to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/123?utm_term=clocks+piano+sheet+music+easy
    • https://cdn-cms.f-static.net/uploads/4463824/normal_5fd159d6631e3.pdf
    • https://cdn-cms.f-static.net/uploads/4367914/normal_602f76b1d029e.pdf
    • https://static.s123-cdn-static.com/uploads/4408478/normal_5fcdad971b2f5.pdf
    • https://static.s123-cdn-static.com/uploads/4419849/normal_5fe5381ec3afe.pdf
    • http://fapasevusiledap.mygamesonline.org/delonghi_1500-watt_ceramic_tower_electric_space_heater_hfx65v15l.pdf
    • https://pexasuwen.weebly.com/uploads/1/3/4/5/134593650/sutijuvir-bemutodewofina.pdf
    • https://cdn-cms.f-static.net/uploads/4471275/normal_601910fde8264.pdf
    • https://vunozeguwogiwe.weebly.com/uploads/1/3/4/7/134745761/1458807.pdf
    • https://cdn-cms.f-static.net/uploads/4383802/normal_602709e7eecaf.pdf
    • https://cdn-cms.f-static.net/uploads/4369520/normal_6017b1008eabc.pdf
    • https://static.s123-cdn-static.com/uploads/4489042/normal_5ff11a07031e3.pdf
    • http://wolifote.getenjoyment.net/all_passive_tenses.pdf
    • https://cdn-cms.f-static.net/uploads/4413851/normal_602e7c00f2be9.pdf
    • https://cdn-cms.f-static.net/uploads/4459341/normal_6019c6880ea41.pdf
    • https://static.s123-cdn-static.com/uploads/4468286/normal_5fee10b647331.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/a68346c1-ff11-4558-8314-8a72906e2443/how_are_monthly_dividends_paid.pdf
    • https://uploads.strikinglycdn.com/files/213af66a-cb5b-4447-978d-3ffb262e16fd/5453345311.pdf
    • https://uploads.strikinglycdn.com/files/4dd56cd3-c93b-4782-95af-6a6173a769d9/sub_zero_650_price.pdf
    • https://uploads.strikinglycdn.com/files/5c3879b5-198d-40e5-ab81-6fe2b1bf7646/bujekopinejolumefafiruvu.pdf
    • http://wobadumiravolu.atwebpages.com/47361106301.pdf
    • http://kosezofejesuxef.atwebpages.com/az_100_premium.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f06a.bin
826c55a3268dad77d758c33e49bf127fb4fa366050776450bf0d85933468aa92		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF06A 5148 bytes
font_01_sfnt_off000101d2.bin
7eebda2d090e206d475c07c95395df490a203456be017e23dbb82cc32cbe8673		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101D2 11532 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.