Malicious PDF — malware analysis report

Static analysis result for SHA-256 e3c1a12524c6c277…

MALICIOUS

PDF

65.2 KB Created: 2020-12-17 01:27:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: 9a7cec76304a3175135ada291f50360c SHA-1: 1fac7265339c1d5a31e2bb1792c5e5caf59bfbec SHA-256: e3c1a12524c6c27785493ba4814776d9b0d7981069d426888235aa293da094ca
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that, when visited, likely leads to a malicious site. The document body, though heavily obfuscated, suggests a lure related to a 'Husqvarna 55 chainsaw owners manual', indicating a phishing or scam attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/strik?utm_term=husqvarna+55+chainsaw+owners+manual PDF link annotation
    • https://webeboxux.weebly.com/uploads/1/3/4/4/134493090/ac55ad.pdfIn PDF document text
    • https://dirigesibujov.weebly.com/uploads/1/3/0/9/130969991/melubuxam-xujewaselo-rebilinovux-debupizusi.pdfIn PDF document text
    • https://lodirunesu.weebly.com/uploads/1/3/0/8/130874391/2a74280d.pdfIn PDF document text
    • https://duxegebipuvakij.weebly.com/uploads/1/3/4/0/134095857/6bbd9b2.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/felasorarabipis/les_orientations_du_def_2019.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c2ec3871-7e23-4d55-a87b-5ad92ee8ffa9/47806242456.pdfIn PDF document text
    • https://s3.amazonaws.com/kavitokolezub/jidomipajanakarunewa.pdfIn PDF document text
    • https://s3.amazonaws.com/zurovajij/ccleaner_piriform_filehippo.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf5e31e18c5c478ef386c0/1606377021227/sitapu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/805668cc-9f8c-433f-be8c-6595486dde66/the_crew_xbox_360_freeboot.pdfIn PDF document text
    • https://s3.amazonaws.com/jaxesabi/5352561435.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc11c6aec917750a3d920aa/t/5fc3ca4c2dd96f591861b60a/1606666829282/movuxorenaxutojogalujada.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0879da3bf4b14aba759f2/t/5fc320c89ee0f32b87b9f93a/1606623434453/fuwitoxisorazo.pdfIn PDF document text
    • https://s3.amazonaws.com/pokixovuxik/duxageme.pdfIn PDF document text
    • https://s3.amazonaws.com/kofabube/67113143730.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bed1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBED1 5400 bytes
SHA-256: a25382b8e9dd5ed5e3aabf113c73fa4cc10a529bb4cb5419da37cb7ee9cafcb8
font_01_sfnt_off0000d120.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD120 11216 bytes
SHA-256: e7218abad4a3fbf73f13768d0bc6fac934fa0896d2709f4b84644f0dead20bfb

Open this report in the interactive analyzer, or submit your own file for analysis.