Malicious PDF — malware analysis report

Static analysis result for SHA-256 ee7fafb8c1a60ad4…

MALICIOUS

PDF

77.6 KB Created: 2021-03-07 06:22:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-14
MD5: a2ca19e1b0debfcb10a2a20d30fe3655 SHA-1: 9ceb1fc05c6bf4230deed8d5e51b3b29214d1211 SHA-256: ee7fafb8c1a60ad4bf253fc57d538b76ee0ef179cc32ae0cab2a169d823f16d2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to a suspicious domain, likely intended for phishing or malware distribution. The document body, though heavily obfuscated, contains references to 'Delta loop antenna' and application metadata suggesting it was generated by wkhtmltopdf, which can be used to create malicious PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=delta+loop+antenna PDF link annotation
    • http://wapavekegiwuxaw.iblogger.org/shoot_bubble_deluxe_apk_free.pdfIn PDF document text
    • http://lewodazegozi.iblogger.org/6029383261.pdfIn PDF document text
    • http://wiwexar.22web.org/74272167994.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://zepogofeto.epizy.com/nadamobalovatimapipifufok.pdfIn PDF document text
    • https://07d68bf2-0661-47e2-9ffe-eae068a071af.filesusr.com/ugd/fef806_60e3f8bf0f764b84a03ad4ac02db3469.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fuvidokibet/how_to_rig_live_bait_for_shore_fishing.pdfIn PDF document text
    • http://pufaperimixalet.epizy.com/2985492786.pdfIn PDF document text
    • https://c2c662fa-00ac-4c69-bf5d-04da7d6c99e2.filesusr.com/ugd/9b33c5_375455d2a8a049fdaa1c25e525910211.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/loxopudizus/1155438296.pdfIn PDF document text
    • https://7fd92c66-d3af-485c-b7a9-31529ddfb1b5.filesusr.com/ugd/997d0f_4297812f6f60404b9947dc2756c816e5.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/8a7bb8cb-759b-400d-bf85-75cce70e3e5d/american_gods_book_show_differences.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2d54346b-0d98-4369-be16-f6bc46b7c0ee/pipe_fitters_blue_book.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c32187b9-21ed-40f4-82cc-75e2eca3f8c9/pathfinder_iron_gods_classes.pdfIn PDF document text
    • https://s3.amazonaws.com/bidemewufa/80845282765.pdfIn PDF document text
    • https://0dd0cd87-80d3-4eb5-b9c6-73c43c3a6fca.filesusr.com/ugd/f0b6b3_1e061172e4b140afa2bc91b133645244.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/ee795482-c1c2-45d9-b912-2fc844431e5f/sejisovobabute.pdfIn PDF document text
    • https://e6f9d1db-9bad-45ba-a188-0e8e378e8087.filesusr.com/ugd/99b222_66fbad370354494aa44a4e9c3a82da08.pdf?index=trueIn PDF document text
    • http://leduvusiluvev.rf.gd/compound_inequalities_worksheets.pdfIn PDF document text
    • https://s3.amazonaws.com/jixeremipet/bedubanupuned.pdfIn PDF document text
    • http://lulatupesufij.epizy.com/ximaxo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/df19cc40-9f85-4e9b-9e75-f2933bf4db3d/what_is_argumentative_essay_and_examples.pdfIn PDF document text
    • http://xakodalomidu.rf.gd/47894687181.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/66927cc5-ce54-446b-9623-e9b364a3bbf5/gomen.pdfIn PDF document text
    • https://s3.amazonaws.com/gajabedafot/sonicwall_tz400_network_security_firewall_appliance.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e951.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE951 4280 bytes
SHA-256: e78e9018fcd2c3cea6765cb6cb850982b8618988f3cce85461e64cbf8f01d3c9
font_01_sfnt_off0000f7e3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF7E3 10408 bytes
SHA-256: 812c376759f60ddbd38de0f6028f519b80fe162899ae9ed446e2fb91faa7d73e
font_02_sfnt_off00011b4b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11B4B 4324 bytes
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3

Open this report in the interactive analyzer, or submit your own file for analysis.