Malicious PDF — malware analysis report

Static analysis result for SHA-256 e887a71253de8513…

MALICIOUS

PDF

71.8 KB Created: 2021-04-02 12:44:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6d3c3e5b7410718ab2cb9d6f8f3b1288 SHA-1: cf0bb5df2a5fefd0b8d16b0bc499c1c708134d07 SHA-256: e887a71253de8513dc3bbef57d0624da7db4b4afb0d800c62a2517d6c67b4484
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that redirects to a suspicious domain, likely serving malicious content or phishing pages. The document body, though heavily obfuscated, contains what appears to be an address, suggesting a lure. The ML classifier and ClamAV detection strongly indicate malicious intent, consistent with a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wix?keyword=193-105+Avenue+D%252C+Matamoras%252C+PA
    • http://palupalukagu.mygamesonline.org/pokemon_tcg_online_iphone_reddit.pdf
    • https://cdn.sqhk.co/fuwufupi/jgkhjt5/mibixebasadopaluwis.pdf
    • http://kokusurajiguz.22web.org/zapf_calligraphic_801_bold_font_free.pdf
    • https://cdn.sqhk.co/zoxojuvef/jcnjeHZ/81360608357.pdf
    • https://cdn.sqhk.co/gufemazibafi/jiIhghj/49525707322.pdf
    • https://cdn.sqhk.co/gujadozede/bifgdgc/sea_battle_2_apk_full.pdf
    • https://cdn.sqhk.co/bikegola/gfjdjfr/puxitofag.pdf
    • https://cdn.sqhk.co/juxerawabuf/Lijiaji/fubamatekebolakuwojuvafu.pdf
    • https://cdn.sqhk.co/nodujugebi/haS4ghd/fashion_photo_ruview_all_stars_5.pdf
    • https://cdn.sqhk.co/tevosenijosu/jfUxjav/bukabage.pdf
    • https://cdn.sqhk.co/dasadogiso/heuGijl/natakawusigizofedunog.pdf
    • https://cdn.sqhk.co/naketego/jaIPje4/53470776845.pdf
    • https://cdn.sqhk.co/zudilubal/Vid1ifH/walmart_inhome_delivery_careers.pdf
    • https://cdn.sqhk.co/rekosiseweno/aCqtuHt/52925978165.pdf
    • https://cdn.sqhk.co/pudamunipum/ggfqSDi/kindle_compatible_ebook_formats.pdf
    • https://cdn.sqhk.co/sevimifogu/fii2Fhf/sowovumewineveb.pdf
    • https://cdn.sqhk.co/zimuteraf/CJhHhaW/23460144675.pdf
    • http://polobasopika.mywebcommunity.org/how_the_youth_justice_system_works.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/5ca232a3-8ef9-44ea-bc2c-85ad1fbd7407/how_to_install_netgear_n300_wireless_usb_adapter_without_cd.pdf
    • http://xelaful.epizy.com/76806384336.pdf
    • http://vawinujofupin.myartsonline.com/36425099400.pdf
    • http://fepoxojosatomu.epizy.com/colon_cancer_screening_colonoscopy_guidelines.pdf
    • https://uploads.strikinglycdn.com/files/7717e301-91ad-46ca-84b4-8ad51528021b/48701732844.pdf
    • https://uploads.strikinglycdn.com/files/5865defe-8164-4a09-9864-0cd957e88091/16757349617.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d793.bin
16cd78c1bed7cb10d710d20fc4eaf59dbf4bd30ba5182819b27c3deeb81268e6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD793 5864 bytes
font_01_sfnt_off0000eba3.bin
1ad5d6a074823c9aa6014d5a017387aaeb6e4c63ac1ab4d831a68e752a35b0ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEBA3 11212 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.