Malicious PDF — malware analysis report

Static analysis result for SHA-256 ea0b9cbba6452b61…

MALICIOUS

PDF

75.8 KB Created: 2021-04-21 06:12:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 219ffffac4362464ba28b9337fc1dea5 SHA-1: b9d7d551af4b6ad322a15ad8b08dd728c9db6671 SHA-256: ea0b9cbba6452b61314b4ec7bb9149cac5b92b1985e4eef787c6986110636e00
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF was flagged by a machine learning classifier and ClamAV as malicious, with ClamAV identifying it as a phishing trojan. The document contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site. While no scripts were explicitly extracted, the presence of embedded URIs and the ML/ClamAV detections strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9956

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=cub+cadet+1045+specs
    • https://cdn.sqhk.co/mujekesire/pNtvijh/fantasy_premier_league_app_android.pdf
    • http://xijonofupawulo.mypressonline.com/89157335749.pdf
    • https://cdn-cms.f-static.net/uploads/4413361/normal_6010c4ead8654.pdf
    • http://potobol.22web.org/dujazadujunedemova.pdf
    • http://dressnbuy.com/dodagajivogox1mvie.pdf
    • http://spoonnumberone.xyz/dadobofurumupavuxe6pk3u.pdf
    • https://cdn.sqhk.co/jakabapewuv/Kijjigi/50870405726.pdf
    • http://prechambre.xyz/how_to_print_wirelessly_hp_envy_4500q3crg.pdf
    • https://cdn.sqhk.co/muligumixe/JianhiF/70663669015.pdf
    • http://italysummer.fun/58045298652c420.pdf
    • https://cdn.sqhk.co/labojime/P6ja9ge/bluestone_paver_patio_ideas.pdf
    • http://juborad.mywebcommunity.org/wemami.pdf
    • https://cdn.sqhk.co/golemejexeno/jLRjhgX/990488513.pdf
    • http://jewlgems.com/definition_of_safe_haven_psychologyyng57.pdf
    • https://cdn-cms.f-static.net/uploads/4377679/normal_6067ee916cf86.pdf
    • http://nubolutlion.xyz/12209231874w6utq.pdf
    • https://static.s123-cdn-static.com/uploads/4417813/normal_5ffb2fece4565.pdf
    • https://cdn-cms.f-static.net/uploads/4374951/normal_600ce3c00b6ce.pdf
    • http://instapriz365.online/the_red_umbrella_chapter_5_summaryibsl9.pdf
    • http://helpverifybadges.com/journey_to_the_center_of_the_earth_3d_dvdbssrv.pdf
    • http://givupuxorow.iblogger.org/98900949522.pdf
    • http://osmosiotzs.fun/how_to_work_out_residual_value_of_a_carrrhq9.pdf
    • https://cdn-cms.f-static.net/uploads/4387825/normal_6067791475d86.pdf
    • http://xoroketogejuxe.mywebcommunity.org/tofemimoxobepatudofi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://livukuxuperum.epizy.com/1995_polaris_trail_boss_250_review.pdf
    • http://letutemoxeluz.onlinewebshop.net/17142933303.pdf
    • http://funixeja.rf.gd/1831345411.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9ce.bin
29726946c6981edb5f28f93ce71ba9e8c76220509ddd3c77ab1317fdd62d73bf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9CE 5388 bytes
font_01_sfnt_off0000fc37.bin
d25a4e0c08faa03f4fe0cdff8c39776a57569eb0e9e55f6d0b1e074394e32e4d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC37 10584 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.