Malicious PDF — malware analysis report

Static analysis result for SHA-256 e52bc6df6b114e81…

MALICIOUS

PDF

84.2 KB Created: 2021-03-24 00:33:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 726482a6c45da1951027c4ef17a40bbe SHA-1: 72d7e797b73c1153e7085a5e5497747fd257af12 SHA-256: e52bc6df6b114e814b390b72c0324dcb412d3696aeec06fa99fa8aebe288775d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ClamAV and an ML classifier. It contains an embedded URL pointing to a suspicious domain, likely used to host or redirect to a malicious payload. The document body, though heavily obfuscated, suggests a lure related to software downloads, consistent with phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/123?utm_term=allshare+play++pc+windows+7
    • https://cdn-cms.f-static.net/uploads/4465133/normal_6010c7c160af9.pdf
    • https://cdn-cms.f-static.net/uploads/4369768/normal_604dc7513bb4c.pdf
    • http://mamimufexaliro.66ghz.com/cutting_edge_advanced_tests_with_answer_key.pdf
    • https://cdn-cms.f-static.net/uploads/4377704/normal_604b1d4831174.pdf
    • http://heleogose.online/gumolegedugijirawigiju45zvd.pdf
    • http://dkblogin-de.com/i_dont_care_i_love_it_lyrics_meaning8fi6v.pdf
    • http://onlinetiser.website/heat_n_glo_fireplace_remote_syncpu3gy.pdf
    • http://bigchance.pw/13105116682atvbf.pdf
    • https://cdn-cms.f-static.net/uploads/4383912/normal_6059abe6bef08.pdf
    • http://saveyoutubebot.com/respironics_evergo_portable_oxygen_concentratorndd68.pdf
    • https://cdn-cms.f-static.net/uploads/4446924/normal_603777f7b5ff4.pdf
    • http://lnstagram-office.com/elite_motors_inc._kennesaw_ga_30152y9km2.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://fe2b84af-b373-48e0-a714-f820169e3fe9.filesusr.com/ugd/ed1d2e_107f137a9463457ebba2fed2e95a7df1.pdf?index=true
    • http://kidagemomosate.epizy.com/action_bar_hide_android_studio.pdf
    • http://bepuvebawufik.epizy.com/rurugifixefafebiga.pdf
    • https://uploads.strikinglycdn.com/files/dde7ed00-24c9-4921-92da-edfd41070167/kurusexodawaxed.pdf
    • https://a1c9bafd-2917-4c1b-b79c-a4b44a941470.filesusr.com/ugd/f0f215_308f197f9a40486c95da83bb9bc85032.pdf?index=true
    • https://40e214c1-1950-44e8-a195-e2c6eeb23253.filesusr.com/ugd/a517f4_1eb778f5ce2e42fdbf751fea20da83fd.pdf?index=true
    • http://vokunewegulu.epizy.com/fb_group_report_link.pdf
    • https://uploads.strikinglycdn.com/files/8ce93f91-142f-41c8-a2b4-95aeb851db28/96697820257.pdf
    • http://wuredavamawot.rf.gd/comment_citer_un_document_dans_une_bibliographie.pdf
    • https://uploads.strikinglycdn.com/files/5d5f98ea-6a76-4219-80a7-de0e5efce1d4/bradesco_seguros_auto_sinistro.pdf
    • https://uploads.strikinglycdn.com/files/b7c08a58-7cdc-413c-8311-3e6ca2a99c7c/72248134997.pdf
    • https://84d5b3ab-51dd-4312-87b7-51df18fb3b26.filesusr.com/ugd/9ea9b6_7ecded61de964cb989a5f9dd3d1ada2a.pdf?index=true
    • https://dbb1fad9-9c05-458f-9e32-bc0b7f65d7ec.filesusr.com/ugd/451461_215703b69470452db6c4db27c6768762.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e934.bin
898c100ce31f165a0588324480bf9e01d779980d2f00752579153ea0199e3aac		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE934 5424 bytes
font_01_sfnt_off0000fbbd.bin
a5c72dab5857add1001f7ec049dd69edf765b00cd75335bbd8c7699d19d06b12		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFBBD 21608 bytes
font_02_sfnt_off00012c13.bin
2c5f1a2e3d9f683f6a217a47aeaaae813f7d4ef732a5ff54a929695507d09140		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12C13 16092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.