Malicious PDF — malware analysis report

Static analysis result for SHA-256 e850e10a5ac0af0b…

MALICIOUS

PDF

72.3 KB Created: 2021-03-14 06:16:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: ce7b73680b6d3919cad221378e18f62e SHA-1: 26e7e361b78abeeb17996cd7f4521ec946c1668e SHA-256: e850e10a5ac0af0be53a659551c969959a3668454ab733e7f73af3690b86407c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely used to host a malicious payload or phishing page. The document body, though heavily obfuscated, suggests a lure related to a song or textbook, aligning with common social engineering tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=bro+hoe+song PDF link annotation
    • http://vuzuwul.getenjoyment.net/guxurop.pdfIn PDF document text
    • http://wunadimizurened.medianewsonline.com/nerojetiwiwerodeduxafar.pdfIn PDF document text
    • http://bilkan.fun/leaves_from_the_vine_violin_sheet_music2nbjp.pdfIn PDF document text
    • http://mediaverifiedbadge.com/wijasoxososol4qz8z.pdfIn PDF document text
    • http://xosubowavenu.mypressonline.com/83185986655.pdfIn PDF document text
    • http://manamuposa.getenjoyment.net/what_is_the_latest_ipod_nano_generation.pdfIn PDF document text
    • http://triple-doska1.club/58292074648wp1a6.pdfIn PDF document text
    • https://cdn.sqhk.co/gobikazifelo/ejfehd4/sabbath_school_lesson_review_2019.pdfIn PDF document text
    • https://cdn.sqhk.co/definuseju/jcxiaha/kegigusunawemo.pdfIn PDF document text
    • http://sparzha.club/kanchenjunga_assamese_movie_song_asomi._inm1lvi.pdfIn PDF document text
    • http://businesslinecenter.com/consumer_behavior_building_marketing_strategy_12th_edition_ebooka4tjn.pdfIn PDF document text
    • http://dvestideyli.xyz/wafiminakekipp5.pdfIn PDF document text
    • http://rastet-malysh.ru/sasimijederijolewufadenmnozz.pdfIn PDF document text
    • http://telovajov.medianewsonline.com/bhagavad_gita_quotes_in_telugu_download.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/fekife/conceptual_physics_textbook_chapter_2_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/sojaxub/argumentative_essay_planning_template.pdfIn PDF document text
    • https://s3.amazonaws.com/sifawekujiki/activity_based_costing_chapter.pdfIn PDF document text
    • https://s3.amazonaws.com/rovuweraja/sewepolerajemolives.pdfIn PDF document text
    • https://s3.amazonaws.com/potofaw/spider_man_3_game_for_mobile.pdfIn PDF document text
    • https://s3.amazonaws.com/baxadelefofibuz/guider_pens_review.pdfIn PDF document text
    • https://s3.amazonaws.com/wemazun/holland_lop_rabbit_care_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/farowug/71894197614.pdfIn PDF document text
    • https://s3.amazonaws.com/jexijer/amyotrophic_lateral_sclerosis_adalah.pdfIn PDF document text
    • https://s3.amazonaws.com/xijalovelokolep/32286020431.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000df8a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDF8A 4756 bytes
SHA-256: 7f2e52c12d6ee73ec4d4b8f01584c53922f8a8a23988d63db7a9474143a6609a
font_01_sfnt_off0000efb5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEFB5 11020 bytes
SHA-256: 7b177512055e340bde11449c99507fbfc431bda84983b109a1de0b8c5db45acc

Open this report in the interactive analyzer, or submit your own file for analysis.