Malicious PDF — malware analysis report

Static analysis result for SHA-256 ec28d9d2592a4818…

MALICIOUS

PDF

104.1 KB Created: 2021-03-27 22:17:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ada53e1199601c1918109d2615b7f5b0 SHA-1: c81ab53724192f75884a3299cfa903d211ae3075 SHA-256: ec28d9d2592a4818b42fbee01f3e56ca92f68f7d9bffaa76f68bbb7a88487746
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that masquerades as a search result for "50 dirty jokes in hindi", likely to trick users into visiting a malicious site. ClamAV detection and ML classification strongly indicate malicious intent. While no scripts were directly extracted, the presence of embedded URLs and the nature of the lure suggest a phishing or redirection attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9957

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=50+dirty+jokes+in+hindi
    • https://cdn.sqhk.co/nurijodefa/Vughyhf/management_consulting_services_sic_code.pdf
    • http://zathkatow.xyz/41612030451eqlap.pdf
    • http://xruhdfo.site/goxuvumuzuf7mf8t.pdf
    • https://bigikudas.weebly.com/uploads/1/3/0/7/130775628/jesapafu-pixidorewomafit-nepigusuxefunex.pdf
    • https://viwefinorix.weebly.com/uploads/1/3/0/8/130813514/seleloxowulesojovam.pdf
    • https://cdn.sqhk.co/rasadenibe/icpjaji/black_and_white_buffalo_check_crib_sheets.pdf
    • http://sifimomikev.sportsontheweb.net/lotagirutuzezekipemeruf.pdf
    • https://kofovozeregom.weebly.com/uploads/1/3/4/3/134313602/xujalisixesajuxikol.pdf
    • https://cdn.sqhk.co/fiduzosi/jiThcgi/segilifibimubo.pdf
    • http://nupifijaw.getenjoyment.net/nuevo_acuerdo_de_paz.pdf
    • http://nigemutekilum.mypressonline.com/ziwilitatude.pdf
    • https://powelogub.weebly.com/uploads/1/3/1/8/131871449/6e32bac16e3e3.pdf
    • https://lejuziluzamof.weebly.com/uploads/1/3/4/8/134863123/fasetusifoguka.pdf
    • http://my-favshopd.online/shark_navigator_dlx_vacuum_filtersk4fja.pdf
    • http://lbaranaydin.com/adverbs_worksheets_6th_gradeibb0o.pdf
    • http://ruluzuzadol.mypressonline.com/the_leftovers_book_series.pdf
    • http://lady-bug.club/xobobexebobamokesipomugalj231j.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • https://s3.amazonaws.com/kofabube/ansys_cfx_theory_guide.pdf
    • https://s3.amazonaws.com/bibejovixapis/why_is_my_ac_unit_compressor_not_working.pdf
    • http://nuzikenevizut.onlinewebshop.net/dokemix.pdf
    • https://s3.amazonaws.com/sogovekevi/wifemib.pdf
    • https://s3.amazonaws.com/vuliwisuwig/55061611927.pdf
    • http://xuvekixofeku.onlinewebshop.net/how_to_turn_volume_down_on_adt_panel.pdf
    • https://s3.amazonaws.com/wanasuvedigo/togekizuketijo.pdf
    • http://laxolagodofomug.onlinewebshop.net/tojipemesojogowen.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNU
    • http://www.gnu.org/copyleft/gpl.htmRegular
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010fbb.bin
431142a4e5795be425eab1a37164a51752f77315709b475b6f0340e9425d8628		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10FBB 5084 bytes
font_01_sfnt_off00012113.bin
d0c9e33916e9e64e42e31bcf0d345f6c2fcd41735b1a34df0119bd0eb1094281		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12113 3720 bytes
font_02_sfnt_off00012c77.bin
ae7e970b6decea1b928a163507765c86c11153fc7a2a63746a09914c2d5ee7b8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12C77 10816 bytes
font_03_sfnt_off000151a0.bin
49f94c099222b2b083c5b1335efd6a58e95aee5760051651c8c8458a3fa7a8b5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x151A0 16620 bytes
font_04_sfnt_off000167eb.bin
2e6803696aaab0961db572c1da21b7ec58c21fbf32b71c2191bef1a01042d3b9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x167EB 14316 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.