Malicious PDF — malware analysis report

Static analysis result for SHA-256 e60a1293e50ddaa5…

MALICIOUS

PDF

71.9 KB Created: 2021-03-25 11:28:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 37779c00f80447d85ec38c798a7f4651 SHA-1: 90ebea97df96c7887eef96f950f0ab20c51d79fe SHA-256: e60a1293e50ddaa5556194c6ae2acf779643a4d80147cfce80a18b1272c108b6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that is highly suspicious and flagged as malicious by ClamAV. The document body, though partially corrupted, suggests a lure related to PDF manipulation tools, which is a common tactic for phishing or malware distribution. The presence of an external URI points to the likely intent of directing the user to a malicious website.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=split+merge+pdf+windows+10
    • https://cdn-cms.f-static.net/uploads/4384480/normal_600b36607dc39.pdf
    • https://static.s123-cdn-static.com/uploads/4389606/normal_5fff70161b635.pdf
    • http://zomolejefej.mywebcommunity.org/xuminunoxosagunabilonasu.pdf
    • https://cdn-cms.f-static.net/uploads/4450419/normal_602d70241c456.pdf
    • https://cdn-cms.f-static.net/uploads/4403117/normal_5fdb5cbb0525f.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/bc661ded-19b6-46c6-90fe-5fb6f7154b82/2_for_5_at_burger_king_2020.pdf
    • https://s3.amazonaws.com/pozokimepe/jotokakilabifekujo.pdf
    • https://s3.amazonaws.com/fusidejebi/45568776495.pdf
    • https://uploads.strikinglycdn.com/files/089f6e5d-2acd-4d1b-93e7-2b48aa4bf97b/mizilewirizejidosa.pdf
    • https://uploads.strikinglycdn.com/files/26af1b92-8482-415a-ba44-f3776cc1017d/85612849694.pdf
    • http://letutemoxeluz.onlinewebshop.net/alphabet_francais_a_imprimer.pdf
    • https://uploads.strikinglycdn.com/files/eb046e75-c665-4767-8f7e-3e421c5d1f0f/dracula_book_summary.pdf
    • http://kilarosine.atwebpages.com/what_are_some_good_workouts_for_basketball.pdf
    • https://s3.amazonaws.com/satedafadusizo/vivegi.pdf
    • https://uploads.strikinglycdn.com/files/1c96ef7c-e869-4fb0-b08a-194b5bda155a/gofofemuzuse.pdf
    • https://s3.amazonaws.com/limepusotanal/optiplex_755_sff_drivers.pdf
    • https://uploads.strikinglycdn.com/files/d4e974f0-7ee7-4632-a531-bb4dc46b396e/romeo_juliet_malayalam_movie_actress_name.pdf
    • https://uploads.strikinglycdn.com/files/3bd8e903-e77e-447d-aa70-ad288c548981/72993394291.pdf
    • https://uploads.strikinglycdn.com/files/b7eede18-0d04-4486-a32a-c20b935a5469/how_to_say_jekyll_and_hyde.pdf
    • http://jonesojawu.myartsonline.com/mufatalizibox.pdf
    • https://s3.amazonaws.com/pasawexawinogad/whats_is_meant_by_double_bubble_map.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db56.bin
5f707739481029a2e9068907efe07fd741aaffe7c40188ecfb8415a10d751052		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDB56 5540 bytes
font_01_sfnt_off0000ee38.bin
7eb0bf4fa41874e4e3f8cb2cad3d574c3dea68622823dea57254da6b34a53ae2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE38 10652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.