Malicious PDF — malware analysis report

Static analysis result for SHA-256 dc5ba2c8221be3f6…

MALICIOUS

PDF

74.1 KB Created: 2021-04-15 19:28:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: dfce97a514f99a52c9e477bb5411c397 SHA-1: ddf255c40a78e695279e37b7cec2a389aa560284 SHA-256: dc5ba2c8221be3f60fec843c3f062e5c8b43b6cb66e68720f3bc764c35d6d4d7
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains an embedded URL pointing to a suspicious domain, which is likely used to deliver a secondary payload or conduct phishing. The document body, though heavily obfuscated, suggests a technical document lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=brocade+fabric+os+administration+guide+7.3 PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4478655/normal_6025bee246a11.pdfIn PDF document text
    • https://cdn.sqhk.co/ruvonusebex/yMUbRhj/sujovufo.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4404122/normal_5fec0aaf910fd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379618/normal_600dd8fa2e02f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4470405/normal_60087a4786a36.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4379970/normal_5fc97ce221b69.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4480161/normal_5fc71b751fb30.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4407102/normal_5fd8192cf2ee0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4385635/normal_603b497343d33.pdfIn PDF document text
    • https://cdn.sqhk.co/kidurukazag/RaXQgc3/41037245859.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421466/normal_5fd670c6d78b5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408177/normal_605fa87082479.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/rokuwapesu/rekiwalev.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0782bebe-2112-404f-8843-96b2139cd27b/sap_transaction_to_view_outline_agreement.pdfIn PDF document text
    • https://s3.amazonaws.com/sizadagazagaj/film_directing_shot_by_shot_-_25th_anniversary_edition.pdfIn PDF document text
    • https://s3.amazonaws.com/woxewiwupir/pezorudukikopefuro.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/26c8fd00-8c3a-495d-a22c-f1ac1b862bca/speed_velocity_and_acceleration_calculations_worksheet_answer_key.pdfIn PDF document text
    • https://s3.amazonaws.com/muwomapotumugi/best_performing_superannuation_funds_australia_2017.pdfIn PDF document text
    • https://s3.amazonaws.com/tirimofufemukat/vert_shock_program_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/156fed89-32d7-469c-9e5c-bcfe2d5903ec/how_to_save_mp3_to_iphone_without_computer.pdfIn PDF document text
    • https://s3.amazonaws.com/risalenefazozo/hundreds_chart_printable.pdfIn PDF document text
    • https://s3.amazonaws.com/vavapekadoliti/dental_assistant_cv_template.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3cbb48f6-897f-412b-b363-2fc5951a5855/33696234969.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a4f55dac-af98-4eca-8226-097847150606/jutisusurotexazoki.pdfIn PDF document text
    • https://s3.amazonaws.com/zafijukopa/jubijaloxobuvalawazewoxo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e315.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE315 5776 bytes
SHA-256: d288aacb2b333e384b3fbb9763541547834ece6027f274f91a01c2ed6b0594c8
font_01_sfnt_off0000f6bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF6BB 10536 bytes
SHA-256: 827e12689b59088fca64e073439742296d929bb412e5164339af1e9d9b3c9ecb

Open this report in the interactive analyzer, or submit your own file for analysis.