Malicious PDF — malware analysis report

Static analysis result for SHA-256 ee9667284338ca65…

MALICIOUS

PDF

83.4 KB Created: 2021-05-23 21:13:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: 747c6f6801b9e506a20110e21af73be4 SHA-1: 2659df60ead2debd431d5f30b2f9befaea7fd705 SHA-256: ee9667284338ca65e6aca203c705edae71de3f99fc818d633b586129d6d1f963
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains an embedded URL that redirects to a phishing site, disguised as a personality quiz. The ML classifier and ClamAV detection strongly indicate malicious intent. No scripts were extracted, but the presence of an external URI points to a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/strik?utm_term=what+personality+type+is+best+for+intj PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4367019/normal_600817d185932.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4392207/normal_6038d13bb78ae.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4424013/normal_600abc6170e38.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4419415/normal_5fdb537c0de0e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408706/normal_6017492fc4da7.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4470828/normal_60021d64db43c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446147/normal_60557231b3271.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373505/normal_5fd183646ab90.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366306/normal_60652d399cc58.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4474988/normal_605f62d8ea266.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4443619/normal_5fdb57ca2e7ff.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/kudufigunabi/sanimozabefijomiwevo.pdfIn PDF document text
    • https://s3.amazonaws.com/xujitezu/lodebenovarewu.pdfIn PDF document text
    • https://s3.amazonaws.com/palikuvexake/69825750578.pdfIn PDF document text
    • https://s3.amazonaws.com/bufipevuril/bachpan_ki_yaadein_video.pdfIn PDF document text
    • https://s3.amazonaws.com/wupiwupiwot/graco_nautilus_80_elite_expiration.pdfIn PDF document text
    • https://s3.amazonaws.com/nelizenejakarug/dotupovofexubumuxidal.pdfIn PDF document text
    • https://s3.amazonaws.com/wizomoravazub/video_er_firefox_48.pdfIn PDF document text
    • https://s3.amazonaws.com/widiku/77440475912.pdfIn PDF document text
    • https://s3.amazonaws.com/sitok/98736850994.pdfIn PDF document text
    • https://s3.amazonaws.com/rexogeguxosix/a_level_maths_indices_worksheet.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010752.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10752 5320 bytes
SHA-256: 841ea5fa628c0593e7dd41d20dd4d22295acb115647b1244f1a7e2e4547cc812
font_01_sfnt_off0001197a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1197A 10728 bytes
SHA-256: f9adeba6e26a31e807c860147abc0d39ecae68439b3ec82e1947e3e20e96dac2

Open this report in the interactive analyzer, or submit your own file for analysis.