Malicious PDF — malware analysis report

Static analysis result for SHA-256 e35a9744d7472099…

MALICIOUS

PDF

87.0 KB Created: 2021-06-28 15:04:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: d300a9ba1c02372dd548e3f9bf05f7cb SHA-1: 9de066716ff9ff23652d91f732ea6226e1426694 SHA-256: e35a9744d747209911ad7060a42361a998212d461238118fc756a5ea1430e611
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample was identified as malicious by a ClamAV signature and an ML classifier, indicating a high likelihood of malicious intent. It contains multiple embedded URLs, many of which point to suspicious PDF files hosted on potentially compromised websites, suggesting a phishing or credential harvesting campaign. Although no scripts were explicitly extracted, the PDF structure and embedded URIs are indicative of malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9930

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xn--78-6kce7dfhb9dwb.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/ddccb4cc57c80f3d8427c21430045ac7/menowevusu.pdf
    • http://c2mag.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bf4d8153b1d---pedojovoremazof.pdf
    • https://inifd.london/uploads/file/kugipikomutubuliseviv.pdf
    • https://www.lightingsolutionsinc.net/wp-content/plugins/super-forms/uploads/php/files/98d9c81787f43507c48ce2ce560c08ce/54463195604.pdf
    • https://www.conkite.com/wp-content/plugins/super-forms/uploads/php/files/9e726a15cb71e4a8e4f5035599fa4f50/xobibinutoposenog.pdf
    • http://andrelandberg.com/userfiles/file/36121046823.pdf
    • https://www.birdandwildlifeteam.com/wp-content/plugins/formcraft/file-upload/server/content/files/16080181306e63---getusop.pdf
    • https://arizonalightingsales.com/wp-content/plugins/super-forms/uploads/php/files/63b5ea738f923ccb3467be5e26ac46a3/90345195630.pdf
    • http://amexeuro.com/an3_Uploads/file/dejurutunigo.pdf
    • https://tangentemag.com/img/file/xalisekiwopiwewono.pdf
    • https://perleyparish.org/wp-content/plugins/super-forms/uploads/php/files/6bf5846fea12a28cb2da5590c89adde5/53626015044.pdf
    • http://www.bewegeninarnhem.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1607c3d2c3d92b---fofaroxurokexazesugok.pdf
    • https://mk-sito.it/uploads/file/11385966089.pdf
    • https://lakeshoresmilesdentistry.com/wp-content/plugins/super-forms/uploads/php/files/ghd1pcvqb5ma9slis2mufspub3/84622576317.pdf
    • https://realwebguys.com/wp-content/plugins/formcraft/file-upload/server/content/files/160aa3f912e493---20774206930.pdf
    • http://riskhedgetech.com/uploaded/file/2497243946093b8d1d424e.pdf
    • https://mattress-leader.com/media/69342671093.pdf
    • http://webscape.co.bw/wp-content/plugins/formcraft/file-upload/server/content/files/16071d13893137---silusom.pdf
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/16090fdf69cf93---27351341144.pdf
    • http://cambridgekapurthala.com/damana/userfiles/file/defuzedeniberoditolol.pdf
    • https://mattweidnerlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/160809ea25e686---jogezomamoge.pdf
    • https://www.kadeavenue.com/wp-content/plugins/super-forms/uploads/php/files/ee56d0dd406e858d505cc31d1ccdd959/43084921051.pdf
    • http://www.veronicaneal.com/wp-content/plugins/formcraft/file-upload/server/content/files/1/160a593fdbf5d9---17364772292.pdf
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/zMnd8XtcwSM/uplcv?utm_term=black+ops+3+zombie+chronicles+cross+platform
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d7c7.bin
d7e20881e69cc6d0f00fd7910aa1cb2bdbde4181aad4028d4b18f938787359ef		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD7C7 11260 bytes
font_01_sfnt_off0000f1de.bin
5c13cceb9d36bbc2bc20aea0fe1d16ac5c722eae827defaa6d249ccd2c25c082		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF1DE 16160 bytes
font_02_sfnt_off00010762.bin
debe635fc355e8533deb2cc0a35ce746b8348188ef557e5e9cda8f689b72a603		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10762 17740 bytes
font_03_sfnt_off000135ce.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x135CE 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.