Malicious PDF — malware analysis report

Static analysis result for SHA-256 ddd6f0ee4b493968…

MALICIOUS

PDF

58.7 KB Created: 2020-12-06 13:51:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-16
MD5: 5e9d9ea1c3bb5338f7919fe51a9a7b58 SHA-1: a8bd4caf61990d53ca175b23a1c3e3ead0951baf SHA-256: ddd6f0ee4b4939681832ecd251657bdcd7c046c87a849eb519ea3dd56c986155
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a suspicious domain, identified as malicious by ClamAV and ML classifiers. The document body, though heavily obfuscated, suggests a lure related to a 'feeding guide'. The presence of an external URI and the overall detection by security tools indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/aws?utm_term=hills+t%252F+d+feline+feeding+guide PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4367920/normal_5fb04299c806e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4371004/normal_5fa054ac4427f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4390330/normal_5f97fbac8ad01.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/46c2a240-23a7-47a4-b7b6-1209d7f591cc/zogufome.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd0c26b474932ca269bcdf/1606224935352/click_jogos_blocky_combat_swat_3.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcf0f86a371610b8765add/1606217977528/la_crosse_technology_wattz_wireless_charging_projection_alarm_clock_manual.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0f27ea13a450babf44921/t/5fc92236152e932360e572c0/1607017017038/71012583119.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc6e713cb936d6a06a62389/t/5fc911828a8a955bdb097ed8/1607012746093/lunevilu.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5515dea4a794d56626c14/t/5fc6d781a907d7439cc892e7/1606866819660/internet_reversi_free.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0cf3a5e8e827d428d5c84/t/5fc123429ee0f32b877b9816/1606492995212/30388928582.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc10aaaf9866f3fd2d521c0/t/5fc315227acac6192a25e123/1606620452238/laws_of_indices.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc59ab6084698658e7e4eec/t/5fc5f87be6d49a06bb60b99a/1606809723938/suzavivak.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4d743946-70fe-4f3d-8925-e12b5e8ca951/fish_cheeks_answer_key.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000acb7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xACB7 4768 bytes
SHA-256: 8d0dfdb84fca9ea79e3a740babd03eef1e9b331bd25ad36d8d7c81f1f4416bd7
font_01_sfnt_off0000bd07.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBD07 9732 bytes
SHA-256: ad720dacee0e0210f80a0f3e77d94420e005fa655661aedd391da825ae7cb41c

Open this report in the interactive analyzer, or submit your own file for analysis.