Malicious PDF — malware analysis report

Static analysis result for SHA-256 ec725504201fdda3…

MALICIOUS

PDF

116.5 KB Created: 2021-03-25 00:52:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ff9f4da4666f71ae8408b9a41889ef75 SHA-1: 2f47436691aac6c1d452394a6357b9217398352a SHA-256: ec725504201fdda3903259ec1f263e1c5fe017d98c29bcb5d2b68e0a0d537e40
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of an external URI pointing to a suspicious domain, combined with the document body's misleading content, suggests a phishing attempt to redirect users to a malicious website. No scripts were extracted, but the PDF structure itself facilitated the malicious redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9975

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=alendronato+s%25C3%25B3dico+70+mg+bula+pdf
    • http://clientbluebadge.com/hitchhikers_guide_to_the_galaxy_quotes_42584tx.pdf
    • http://zekojotewakugag.mypressonline.com/fapilatenedonako.pdf
    • https://cdn-cms.f-static.net/uploads/4406228/normal_605817b2f0f8e.pdf
    • https://cdn-cms.f-static.net/uploads/4405945/normal_603e2581e9991.pdf
    • http://moxipafuxoxo.mygamesonline.org/chemistry_bonding_worksheet.pdf
    • https://static.s123-cdn-static.com/uploads/4413455/normal_5fc77176d5ee4.pdf
    • http://bluetea.space/astrology_predictions_by_date_of_birth_tamilrphml.pdf
    • http://soldonlakewood.com/texas_instruments_ti-nspire_cx_ii_cas_touchpad_colourht9ys.pdf
    • http://pristav.pro/oracle_11g_administration_workshop_2aa2py.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://dasobiviwadodaj.atwebpages.com/72952225192.pdf
    • https://uploads.strikinglycdn.com/files/1f25a3f8-5d57-4bfa-ad95-b81849d68c81/asp.net_mvc_5_dropdownlist_from_database.pdf
    • https://s3.amazonaws.com/muwemivumazulax/does_the_mandalorian_have_bad_language.pdf
    • https://uploads.strikinglycdn.com/files/1a9de233-183a-4cfc-b0d7-54ad529867a5/what_does_it_mean_to_put_on_the_whole_armour_of_god.pdf
    • https://uploads.strikinglycdn.com/files/0d7205a6-b02e-4c36-97df-571779b0d82a/19917677416.pdf
    • https://s3.amazonaws.com/fonazuzixagizir/cuisinart_ice-30bc_pure_indulgence_2qt.pdf
    • https://206c1dc7-391c-4b20-ac64-b63c97020fd4.filesusr.com/ugd/87773f_55e1e2299b9a402eaecd09cef4b05b50.pdf?index=true
    • https://s3.amazonaws.com/baposivarabuj/jiwigukijug.pdf
    • https://uploads.strikinglycdn.com/files/dd29a6b0-1dd7-43ed-a8a5-a8fc956d481d/el_pequeo_vampiro_libro_completo.pdf
    • https://s3.amazonaws.com/pevarijidasalop/amazon_india_apk_mirror.pdf
    • http://xolavozezimodan.onlinewebshop.net/what_kind_of_government_did_the_soviet_union_have.pdf
    • https://5e446c31-fcb6-4427-a178-91ee45bbff8b.filesusr.com/ugd/4e76b8_019d9b96eacf432b91675fa17464bbaf.pdf?index=true
    • http://pixafur.atwebpages.com/how_many_calories_are_in_a_plain_bagel_with_butter.pdf
    • https://uploads.strikinglycdn.com/files/64885dd8-7940-4167-8f17-203a92904772/what_order_to_read_the_shatter_me_series.pdf
    • https://d45380bd-a93d-4ef2-b2bd-4c7806d1f6db.filesusr.com/ugd/5d2cf3_c48ae41bf8c246b4989990d1b6608eaa.pdf?index=true
    • https://s3.amazonaws.com/widiku/what_are_the_six_types_of_a_family_structure_describe_them.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00017813.bin
9c84aca5171cf4522e1fd23f3e5391e17c8e645cdcb740b4c3036af6865bd014		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17813 2900 bytes
font_01_sfnt_off00018258.bin
4fe63ec05d713cd884e0a9bb81cc573e1c2152ed73af84d54547db30864954d8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18258 5964 bytes
font_02_sfnt_off00019650.bin
26b1e44e7dc5b392b72471c87e25e4bda7d6399fb147dfc367c465e654550271		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19650 14552 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.