Malicious PDF — malware analysis report

Static analysis result for SHA-256 e6f540ae45cd1262…

MALICIOUS

PDF

79.0 KB Created: 2021-04-03 23:18:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f6c89435e00efcc771850ef199b6c4a1 SHA-1: 7e010f1ef8bd6cf4299417ecc51ea0f547ac4890 SHA-256: e6f540ae45cd126288e5870b3609a9770791e6e1e73187a2a96b9a68f2b45451
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI that directs the user to a suspicious domain, likely for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were explicitly extracted, the presence of embedded URLs and the document's deceptive content suggest it's designed to trick users into navigating to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9961

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=waste+management+plan+template+nz
    • http://getyourscore.info/mistborn_final_empire_word_count5dooo.pdf
    • https://toxinezewam.weebly.com/uploads/1/3/1/4/131452950/9043198.pdf
    • http://sibatike.getenjoyment.net/mental_math_worksheets_grade_6.pdf
    • https://dibevapanowodi.weebly.com/uploads/1/3/0/7/130776811/ac17375ae.pdf
    • http://haifaiv.ru/bncc_ensino_fundamental_ciencias_da_naturezag05kf.pdf
    • https://cdn.sqhk.co/pigajifaw/ziidE0e/68792135239.pdf
    • https://cdn.sqhk.co/sorubajuzoxe/ihdCjj9/bitcoin_cash_wallet._buy_bch_coins_freewallets.pdf
    • https://cdn.sqhk.co/makafabakuna/ijbffDw/word_market_2_level_40.pdf
    • http://fibaxoxadomi.sportsontheweb.net/51381111268.pdf
    • https://cdn.sqhk.co/litonesi/jjOQYgj/91784379130.pdf
    • http://paktum.pro/406333348524e1d.pdf
    • http://paxezot.getenjoyment.net/bawulejewitepivofu.pdf
    • https://velineninebag.weebly.com/uploads/1/3/4/6/134608195/sikaduxe-bupej.pdf
    • http://oneshops.space/broadside_array_antennarkbjh.pdf
    • http://juxowupekabaf.mygamesonline.org/92588958501.pdf
    • https://cdn.sqhk.co/busibelifiv/NgjDjbF/punukuvikasavuwagaxazipi.pdf
    • http://goodsun.fun/probability_class_9thb0r2p.pdf
    • http://onsideball.info/interior_designing_courses_in_karachi_universityiyr03.pdf
    • http://yazansoft.com/2007_mazda_cx_7_turbo_problemss5w96.pdf
    • http://doweryklkq.space/50241045481uq0ft.pdf
    • http://ig-soft-team.com/68599305542idayv.pdf
    • http://jabewes.medianewsonline.com/77737922610.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/e5e84615-c7c7-4b3f-84e8-75a82ff70b3b/54064545618.pdf
    • https://uploads.strikinglycdn.com/files/9d0ec574-9545-445f-8799-b24793a7ef7d/nostalgia_ice_cream_maker_user_manual.pdf
    • https://uploads.strikinglycdn.com/files/5bec4e0f-41b5-4520-9d8e-e93b11547183/ion_turntable_usb_cable.pdf
    • https://uploads.strikinglycdn.com/files/ef15bb78-e163-4fd5-9d77-963e7614068d/what_is_non_realism_in_theatre.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f8d7.bin
79f5dae5e5d8b281a2adaef5f4bff571e58573b5cc286fea7af5a4b8bb0841be		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF8D7 5104 bytes
font_01_sfnt_off00010a3c.bin
072fd6d5c9fe065936c0a0b09d05dc218722edf2b70533b2910128ef1e671e3a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A3C 10532 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.