Malicious PDF — malware analysis report

Static analysis result for SHA-256 e80951ada55edfb6…

MALICIOUS

PDF

73.6 KB Created: 2020-12-11 00:19:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-02
MD5: d3e391d5a3f80965f58bb7a2a74a4488 SHA-1: 273c2450e05f058f2d4154b3d42dc4b5cd775043 SHA-256: e80951ada55edfb6fc938f7f2f6977105f9c504579a4f827e2ce3581970d9128
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, indicating a phishing attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. Although no scripts were extracted, the embedded URL is the primary indicator of compromise, likely leading to a phishing page or further malware download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/aws?utm_term=everytime+we+touch+piano+sheet+music+pdf In PDF document text
    • https://kebakiwaranug.weebly.com/uploads/1/3/4/3/134317860/8213990.pdfIn PDF document text
    • https://lasaveba.weebly.com/uploads/1/3/4/4/134488520/eadff155.pdfIn PDF document text
    • https://juputifewusa.weebly.com/uploads/1/3/4/4/134435955/011f0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366324/normal_5f95514d78f50.pdfIn PDF document text
    • https://vugawijop.weebly.com/uploads/1/3/4/5/134594760/4f3821390608f62.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4368265/normal_5fccc2f73b307.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388619/normal_5f97c58f9014f.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fcf214afa8be4403e0b1313/t/5fd081f826d54b3c06d44dc4/1607500283144/68978684288.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fcdf642705f6b5d2cc370b9/t/5fce74e4fbb6240de8f84dd5/1607365861807/fall_guys_game_modes_tier_list.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd182b803f460880cc9b37/1606228011843/61659626494.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc123e317e7202640ebafce/t/5fca660dc73aa43e658620fb/1607099917825/ironheart_denim_sale.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc28d7517e7202640f4b4d6/t/5fca9cc752c55e381a181134/1607113927995/new_trending_videos_download.pdfIn PDF document text
    • https://s3.amazonaws.com/suximawo/mimidarovepupixuvarulef.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc37900ec917750a3e8073f/t/5fc4acd85147b14804c6be76/1606724827420/phd_in_entrepreneurship.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc14d4c5bcb0228a2853727/t/5fcab889edb74d54089ac55b/1607121034256/school_days_anime_episode_6_english_dub.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e1cb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE1CB 5576 bytes
SHA-256: 3b9c7aa7cea5f3f0d0cc57ef2426659bd8c69a07b518a03e7d7ae2d4c2e3f1ac
font_01_sfnt_off0000f4b9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF4B9 11124 bytes
SHA-256: 7c3ee1b8091cafd27816712609936bd9f06863f3e63b13e73e171c50312cd999

Open this report in the interactive analyzer, or submit your own file for analysis.