Malicious PDF — malware analysis report

Static analysis result for SHA-256 dd7948fc2140d29d…

MALICIOUS

PDF

84.8 KB Created: 2021-05-08 17:14:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1698b8b5f15164de5733d97d59de923b SHA-1: fd2209bd1e62708e8bc5e5c322d138522e35f87f SHA-256: dd7948fc2140d29d13b9885f691cd4574e603810824795b9391224356253926a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and a machine learning classifier, indicating a phishing attempt. It contains an embedded URL that directs users to a suspicious domain, likely to host further malicious content or phishing pages. The document body, though partially corrupted, suggests a lure related to professional writing, which is a common tactic for social engineering.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=how+to+end+a+professional+letter+of+recommendation
    • https://cdn.sqhk.co/duxapotor/YHAnIsX/red_button_shirt_roblox.pdf
    • https://cdn.sqhk.co/ketixudolu/hcjiuhj/angular_2_form_data_to_json.pdf
    • http://xukejufivakege.iblogger.org/garasumalukivirakinowo.pdf
    • http://gugolufixa.mywebcommunity.org/kejabixet.pdf
    • http://pixujuxe.mypressonline.com/8224029262.pdf
    • https://cdn.sqhk.co/bidelefo/Wjiicia/rugesonusazo.pdf
    • http://sekasululaba.iblogger.org/36313894500.pdf
    • http://xebubux.sportsontheweb.net/34528794593.pdf
    • http://bumasujofoj.getenjoyment.net/35574151645.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/matogapibelifiv/buffalo_wild_wings_nutrition_facts.pdf
    • http://sinusisokopex.atwebpages.com/xefilojunijakokipuvidatof.pdf
    • https://s3.amazonaws.com/lurutopobi/45519566040.pdf
    • http://ripotuteruposa.rf.gd/feasibility_report_on_poultry_farming.pdf
    • http://lewafozilit.epizy.com/41271707077.pdf
    • https://s3.amazonaws.com/kefefetafij/41608001166.pdf
    • https://uploads.strikinglycdn.com/files/25e8454f-95ba-4973-9f05-69ca0dfa1c13/25746346363.pdf
    • https://uploads.strikinglycdn.com/files/db4c7e29-e20a-4187-ad7b-a64110a6aeb9/why_wont_my_lay_z_spa_heat_up.pdf
    • https://s3.amazonaws.com/fezenur/graco_relay_jogger_travel_system_reviews.pdf
    • https://uploads.strikinglycdn.com/files/58c4c041-049b-4e07-9ae5-08e930421b02/lujenakaxoliduva.pdf
    • http://fowuxolizafiful.epizy.com/wikimirunanewo.pdf
    • http://wojixefem.epizy.com/happy_wheels_pc_full.pdf
    • https://uploads.strikinglycdn.com/files/92faf771-5021-4fce-90bd-ab9883d65376/14756758014.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000100fa.bin
d896d2f5e74c9c6150da9b02f94f39288a9c326fdac5034678dc7eadaf950216		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100FA 5144 bytes
font_01_sfnt_off0001126a.bin
1848eb5f4ba78c71a7cd438296602fb3d139f42ae4c2a66089da7f55c39a1cbf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1126A 10860 bytes
font_02_sfnt_off0001378c.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1378C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.