Malicious PDF — malware analysis report

Static analysis result for SHA-256 dfda5b7f7bb153d7…

MALICIOUS

PDF

92.8 KB Created: 2021-04-02 12:42:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fbb052c9c29633dcccfb142ce13b3005 SHA-1: df487126ed5258b26e3a5f496f5ebf4b38d4131d SHA-256: dfda5b7f7bb153d756e4a3763d2af330283d2d92a4b6799eb4e832b381c284ea
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that points to a suspicious domain, identified by heuristics as a potential phishing attempt. The ML classifier and ClamAV detection strongly indicate maliciousness. Although no scripts were extracted, the presence of a malicious URL within the document's metadata suggests an attempt to redirect the user to a phishing site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/award?keyword=business+management+study+guide+pdf
    • https://cdn-cms.f-static.net/uploads/4454682/normal_5fd8ce989a2c5.pdf
    • https://cdn-cms.f-static.net/uploads/4443598/normal_605c63f76d70e.pdf
    • https://cdn-cms.f-static.net/uploads/4500667/normal_60141135280d1.pdf
    • https://cdn-cms.f-static.net/uploads/4420765/normal_606378547fce8.pdf
    • https://cdn-cms.f-static.net/uploads/4369655/normal_603104ab5f154.pdf
    • https://cdn-cms.f-static.net/uploads/4449990/normal_605c86c2ae873.pdf
    • https://cdn.sqhk.co/sirepajaku/qeVGjgt/30824289071.pdf
    • https://cdn.sqhk.co/tuxonewebuke/fthiaV3/3853145792.pdf
    • https://cdn-cms.f-static.net/uploads/4405895/normal_5fe983cc4ea93.pdf
    • https://cdn-cms.f-static.net/uploads/4480387/normal_600d4cffae881.pdf
    • https://cdn.sqhk.co/zojixemem/gjahbMH/pesebamevavu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/1cde19ec-5344-4205-9a0c-803cf4e3a157/75774825531.pdf
    • https://uploads.strikinglycdn.com/files/31eb6b3a-99c4-4b8a-92d7-697666fa4217/is_the_overlook_hotel_from_the_shining_still_open.pdf
    • https://s3.amazonaws.com/zupenafud/kutusoxupukutafigexosi.pdf
    • https://uploads.strikinglycdn.com/files/6559cdbd-b2d1-4855-a7ae-8ee0a10260a7/lizitufija.pdf
    • https://s3.amazonaws.com/pirosisob/holy_is_the_lord_chords_in_g.pdf
    • https://uploads.strikinglycdn.com/files/7ec38a32-d05a-4382-999e-1f893dc04fad/34699038831.pdf
    • https://uploads.strikinglycdn.com/files/3f60e40d-c453-4075-b778-8b5a1e168527/watch_the_disaster_artist_free.pdf
    • https://uploads.strikinglycdn.com/files/bd68f974-ca5f-4148-8438-d3016e641641/how_many_pegs_to_use_on_a_sock_loom.pdf
    • https://uploads.strikinglycdn.com/files/26320efd-de7a-4272-a6da-bd3d6beaa754/browning_auto_5.pdf
    • https://s3.amazonaws.com/mefonevimimix/how_much_does_it_cost_to_rebuild_a_7.3_motor.pdf
    • https://uploads.strikinglycdn.com/files/5a341e57-8fc2-4563-ab9b-eafd1d6f191b/wordsworth_tintern_abbey_summary_and_analysis.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011e25.bin
83838cafe9c4a7ae9d416e0ce07753e74a0eba0de0de8c20c064e8cfd1f515f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11E25 5156 bytes
font_01_sfnt_off00012f9f.bin
f099db16df246d4fd5b3c386f224d319a77f5765193c9ae4f6ab8126d050992c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12F9F 11256 bytes
font_02_sfnt_off0001560c.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1560C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.