Malicious PDF — malware analysis report

Static analysis result for SHA-256 df594951fda4375a…

MALICIOUS

PDF

125.9 KB Created: 2021-03-23 07:09:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-02
MD5: caf1bdb40b8d6b77d2e9606cd0eadb4d SHA-1: c7554d4e214eb9c5e01bb9ee03d926d836eb6c20 SHA-256: df594951fda4375a0e94f1f4887b200ef3b55c719df968054b16642faba50913
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=calculo+diferencial+e+integral+de+granville+pdf PDF link annotation
    • http://blacklaser.ru/dadodapoi3nh4.pdfIn PDF document text
    • http://ponaxamewimenul.sportsontheweb.net/81203778001.pdfIn PDF document text
    • http://kurs1.xyz/search_bar_missing_google_chromeot5sd.pdfIn PDF document text
    • http://misifebofol.mywebcommunity.org/92613952139.pdfIn PDF document text
    • http://molotkov.site/622286470743d6c9.pdfIn PDF document text
    • http://nout-prodat.site/panasonic_ag-ux180_manualeue9d6.pdfIn PDF document text
    • http://laulu-go.ru/5586765887eb6o.pdfIn PDF document text
    • http://mysteps.online/2013_honda_civic_recommended_maintenance_scheduleeboc3.pdfIn PDF document text
    • http://confirmationhelpcenter.com/the_odyssey_part_2_the_return_of_odysseus_study_guide_answersvlsce.pdfIn PDF document text
    • http://quickpapp.online/will_genie_wireless_keypad_work_with_liftmastercoxsw.pdfIn PDF document text
    • http://amaryllis.space/wutowemuzasiwi3xqmo.pdfIn PDF document text
    • http://pubgucbayim.com/los_4_personajes_mas_importantes_de_la_independencia_de_estados_unidoswemjw.pdfIn PDF document text
    • http://uggi-ugg.com/9824617150n1z3f.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/dikobepibelun/comparison_exercises_with_answers.pdfIn PDF document text
    • http://tuzuxutetug.atwebpages.com/how_to_use_the_rainbow_vacuum_cleaner.pdfIn PDF document text
    • https://s3.amazonaws.com/fizufapu/vanujuz.pdfIn PDF document text
    • https://s3.amazonaws.com/dofufiri/vomofizofizamutopomimojar.pdfIn PDF document text
    • https://s3.amazonaws.com/faluzotixupi/xubamefisotivekeruwalek.pdfIn PDF document text
    • https://s3.amazonaws.com/pusixa/4576327759.pdfIn PDF document text
    • https://s3.amazonaws.com/gosete/fofekaputuluxusojiniz.pdfIn PDF document text
    • https://s3.amazonaws.com/gavobawum/what_does_a_black_beauty_mark_mean.pdfIn PDF document text
    • https://s3.amazonaws.com/xezonijida/gubixejenujawipas.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00018a77.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18A77 5112 bytes
SHA-256: b23ad53a26a3a770ad31c00e1452980729d862ca604ba102555cb285b317ef1a
font_01_sfnt_off00019bef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19BEF 2472 bytes
SHA-256: 236a61e16599ec92850f83ba864a0ea1ce7e9f7a1596c8aeb786fa377e8a8a06
font_02_sfnt_off0001a62d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A62D 13468 bytes
SHA-256: 23d630b22efdca667a744eed59abfbfe9ffe62a7585c806f81978f5e09ca3961
font_03_sfnt_off0001d25b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1D25B 16116 bytes
SHA-256: 695712d5df92d2eed50b4f9eb982b07b0a6b62ac427b7a93fdc6d43ac1f200b5

Open this report in the interactive analyzer, or submit your own file for analysis.