Malicious PDF — malware analysis report

Static analysis result for SHA-256 ee847a4988518e4c…

MALICIOUS

PDF

94.0 KB Created: 2021-03-13 20:58:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 919cdd193c904e97c2c26203e85c5979 SHA-1: e0063b61a7406680b43c635b66655113bba8cbcc SHA-256: ee847a4988518e4c17dd1b72b6fb254460bfc645031ee64917d1dedb6288d1cf
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that mimics a search result, likely to trick the user into visiting a malicious site. The ML classifier and ClamAV detection strongly indicate malicious intent. While no scripts were directly extracted, the PDF structure and embedded URI are indicative of a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/award?keyword=augusten+burroughs+dry+pdf
    • https://cdn.sqhk.co/jenotonolo/gifiagd/granny_chapter_two_game_online.pdf
    • https://cdn.sqhk.co/patagarinixa/chfgeG9/tales_rush_mod_apk_1._3._20.pdf
    • https://cdn-cms.f-static.net/uploads/4414332/normal_604ab963d43f0.pdf
    • http://wajobok.iblogger.org/7461363252.pdf
    • https://cdn.sqhk.co/vitikitema/jfgcYaP/vezow.pdf
    • https://cdn-cms.f-static.net/uploads/4455901/normal_604a01a34093c.pdf
    • https://static.s123-cdn-static.com/uploads/4489422/normal_5ff47c793c600.pdf
    • https://cdn-cms.f-static.net/uploads/4465007/normal_60300e2f3f032.pdf
    • https://static.s123-cdn-static.com/uploads/4422368/normal_60069ee3a3f88.pdf
    • https://static.s123-cdn-static.com/uploads/4385410/normal_5fdd30e924bd3.pdf
    • http://xojudesabesone.66ghz.com/concrete_compression_test_lab_report.pdf
    • https://cdn-cms.f-static.net/uploads/4375080/normal_6018f6b9b79f1.pdf
    • https://cdn-cms.f-static.net/uploads/4450041/normal_60247f5d03a3e.pdf
    • https://cdn.sqhk.co/rurizibaxami/YjcAhjC/orange_tree_imports_coupons.pdf
    • https://static.s123-cdn-static.com/uploads/4414161/normal_5fe404432aa7e.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/goveruduzewoxu/bezojilavisuxosixepujakuv.pdf
    • https://s3.amazonaws.com/divikufifir/60539217538.pdf
    • https://s3.amazonaws.com/gezizefefififa/lorozo.pdf
    • https://s3.amazonaws.com/xotomisen/hpu_icdeol_date_sheet_2019.pdf
    • https://s3.amazonaws.com/jikopot/free_telugu_hd_movies_sites.pdf
    • http://gewuruso.epizy.com/warhammer_beastmen_codex.pdf
    • https://s3.amazonaws.com/xaliwalufoguni/eponine_on_my_own_sheet_music.pdf
    • https://s3.amazonaws.com/nasitevu/tuzokugata.pdf
    • https://s3.amazonaws.com/levovod/bricscad_linux_free.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000110b9.bin
f39728c72bfb2443f64656a30536f117863a351a96bfc1dab9b58a21b3374c67		 pdf-font-stream PDF embedded font (sfnt) at offset 0x110B9 5292 bytes
font_01_sfnt_off000122b8.bin
ca2d30c457e78256b71b46c07726c1d1f5e3b91309a35f9d0dad71909bfde798		 pdf-font-stream PDF embedded font (sfnt) at offset 0x122B8 2384 bytes
font_02_sfnt_off00012cbf.bin
7d108456a622ae551fd31c253ee4c9ff83313713cf7d677a2887871238d26576		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12CBF 11204 bytes
font_03_sfnt_off00015329.bin
afdacf064e3809c4db4daecd259e52a2294c181b90c774eb019031fc970cf557		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15329 16664 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.