Malicious PDF — malware analysis report

Static analysis result for SHA-256 e16aa92928903cc9…

MALICIOUS

PDF

74.4 KB Created: 2020-12-15 17:41:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: 419e947fb75b1f6714ecae2c3c365db1 SHA-1: 09588e7e2d8419860bc4fd2ba97d001b52b8d32d SHA-256: e16aa92928903cc93100f94a7c2906fa60899f24156ae9a2a886f34ff7f2de41
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent. Although no scripts were extracted, the presence of a malicious URL within the document body, disguised as a game walkthrough, points to a social engineering attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/123?utm_term=super+mario+bros+the+lost+levels+walkthrough PDF link annotation
    • https://jalewigevat.weebly.com/uploads/1/3/2/6/132681207/ximil_jizeb_kobimatoja_legiveko.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375531/normal_5fd6da4f7751f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4456398/normal_5fa3812011644.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4463538/normal_5fd8d1cde4589.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4377408/normal_5fafb98e49a2b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/1c0cf873-7f5a-472e-92bb-cc0cbcc84422/banasiriguzibam.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc15943ea4a794d56482977/t/5fc2e2993570fb44d162c665/1606607513874/kikefi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4ada14ab-89a8-4d88-aef9-e9c9734e223a/letter_combinations_of_a_phone_number_python.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b86815aa-e799-46e0-a9aa-02ac8a0c0f5f/74804995260.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/774a6010-91b3-4c53-82ee-857c9c097759/maytag_gas_stove_manual.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fcf91e34809fd7eb9e42863/t/5fd66ce1e5ac58289623ca9c/1607888097927/49356568590.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bc11a6da-6e63-45dd-a3cc-266eeb013e0f/tejubovowelivamularokine.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/807f3405-f940-4c68-bcbf-fd0b3a8e02b5/jirojirine.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e3a5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE3A5 5692 bytes
SHA-256: 78e55ee7a2d73d6391ef32b51981529b6f5a42b5201543a2df4879e5d8ff3824
font_01_sfnt_off0000f6e2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF6E2 11168 bytes
SHA-256: ccc23389822f1005704e7b3f8c4ea898f5a83e9c8e459e9b8ec19a1a95143a6f

Open this report in the interactive analyzer, or submit your own file for analysis.