Malicious PDF — malware analysis report

Static analysis result for SHA-256 efcd51ebff24a9be…

MALICIOUS

PDF

85.6 KB Created: 2021-03-14 22:46:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: add2686e621cecbc837c33e95dcd3f89 SHA-1: 2f0faa97ab292606ae06e2b633339d89c6b571e4 SHA-256: efcd51ebff24a9be600b84e4b3d00384f7b98ed09123b7920399607ec8283a08
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing an embedded URL that leads to a suspicious domain, identified as malicious by ClamAV and an ML classifier. The document body, though heavily obfuscated, appears to contain product-related keywords, suggesting a phishing lure. No scripts were extracted, but the presence of an external URI and the high confidence detection scores indicate a malicious intent to redirect the user to a potentially harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/strik?utm_term=husky+20+gallon+air+compressor+silent
    • http://bluebadge-support.com/how_to_find_the_theoretical_probabilityxcx8e.pdf
    • https://cdn-cms.f-static.net/uploads/4418368/normal_60436fac65a02.pdf
    • http://blog-millionaire.buzz/imperio_bizantino_exercicios_resolvidosos4j9.pdf
    • http://yachts-4-sale.com/58039995542nacjb.pdf
    • http://fullcreditreport.info/british_english_and_american_english_wordsq3r5q.pdf
    • http://idealica-italiaoficial.site/collier_county_sheriff_activity_reportmq5sv.pdf
    • http://graatorama.fun/fairy_tales_anime_lucy0kby6.pdf
    • http://kpovli.ru/honda_express_for_sale_gumtreel0rlt.pdf
    • https://cdn-cms.f-static.net/uploads/4475196/normal_6032c71ad66ae.pdf
    • http://4bochki.ru/i_love_you_cg_movie_720pgi1mm.pdf
    • http://mon-compte-cmb.best/33490555253u4011.pdf
    • http://marketitaly.pro/esic_form_7b_free_downloadapko4.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/xulepiwa/kmart_fleece_sheets.pdf
    • https://s3.amazonaws.com/ladojenefe/kjv_life_application_study_bible_third_edition.pdf
    • https://uploads.strikinglycdn.com/files/48214fd1-3127-44d9-90bd-42d1d5b59c7c/hp_officejet_h470_error_printing.pdf
    • https://uploads.strikinglycdn.com/files/56f67535-c4f4-4f82-907c-e15cbc9ba827/75818427084.pdf
    • https://uploads.strikinglycdn.com/files/c78e1a6e-238e-4b46-af93-f3836f5212dd/47841002313.pdf
    • https://uploads.strikinglycdn.com/files/4455547b-0a2e-40e8-b4b0-4c797e15545d/left_behind_audio_books_in_order.pdf
    • https://uploads.strikinglycdn.com/files/9671412f-fc61-462b-ab08-9ce428b78f48/storyboard_pro_free.pdf
    • https://s3.amazonaws.com/suxugipipolazog/94279092839.pdf
    • https://s3.amazonaws.com/wonumafubij/berinagedixujojegagijer.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ff42.bin
ad474fa7b4ddbc0dffd54bd22cc671bf4831d0bb5470f04b70904d11968b6def		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF42 5536 bytes
font_01_sfnt_off00011202.bin
a225cad1fccaf88dbeda5fd8319128d67413f100fdb83571b513309e7d2861af		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11202 11940 bytes
font_02_sfnt_off00013a77.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13A77 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.