Malicious PDF — malware analysis report

Static analysis result for SHA-256 f0478555a49e308f…

MALICIOUS

PDF

91.3 KB Created: 2021-04-05 01:19:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: 3eb312390c7a51ee5e303d3182e1b916 SHA-1: 059d49bf3b4af7ab03dde1e99e19ff5db906f5dd SHA-256: f0478555a49e308f20c0c2da7f79676a64b688a2c565b56c7e1823fd065cf6f2
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing indicating a malicious redirector link, specifically pointing to a URL that appears to be a lure for downloading software. The ML classifier also strongly flagged this PDF as malicious. The embedded URL is likely intended to lead the user to download a second-stage payload, masquerading as a legitimate file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/award?keyword=affinity+photo+workbook+pdf+download In PDF document text
    • https://cdn.sqhk.co/nasubivapu/uew7gff/paper_and_spark.pdfIn PDF document text
    • http://firstsecu-paypal.com/44137972187en841.pdfIn PDF document text
    • https://cdn.sqhk.co/boxewemutox/i2TKii5/nantucket_lobster_trap_reviews.pdfIn PDF document text
    • https://cdn.sqhk.co/nukusigemug/a2hdfdq/easy_ways_to_make_fake_nails_at_home.pdfIn PDF document text
    • https://cdn.sqhk.co/wezufunin/ihjVeSg/zuvisema.pdfIn PDF document text
    • https://cdn.sqhk.co/ketiwuvogi/ihXlrHE/christmas_auld_lang_syne_sheet_music.pdfIn PDF document text
    • https://cdn.sqhk.co/vafebutiman/hgp6z92/aiims_admit_card_link.pdfIn PDF document text
    • http://rankingcoach-apps.com/maloko85er9.pdfIn PDF document text
    • http://santaparker.store/4387925136tk8ax.pdfIn PDF document text
    • https://cdn.sqhk.co/rularijulen/jeiaibR/talazuwapakefekurex.pdfIn PDF document text
    • http://liko-sneakers.com/31047818660tbdh8.pdfIn PDF document text
    • https://cdn.sqhk.co/gapebeve/jcia0jj/gawejuribunitufigovatel.pdfIn PDF document text
    • https://cdn.sqhk.co/japewaturu/hidogcJ/family_tree_template_free_editable.pdfIn PDF document text
    • http://changepass.online/ukulele_strumming_patterns_4_4d4fg6.pdfIn PDF document text
    • https://cdn.sqhk.co/tinulafi/KhifCbl/52708048680.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/paxivogedewilu/pexejowa.pdfIn PDF document text
    • https://s3.amazonaws.com/tugumeb/luvoxujixidimojedo.pdfIn PDF document text
    • https://s3.amazonaws.com/wegemebufojafak/xobinil.pdfIn PDF document text
    • https://s3.amazonaws.com/mosezavor/neoplasia_maligna_de_tiroides.pdfIn PDF document text
    • https://s3.amazonaws.com/zowibatev/mosog.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000117ef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x117EF 5008 bytes
SHA-256: 5ee70d38d6d0bde8680bffe68e47f7d539d86fa4d91e328e45c9c8bba4ade77c
font_01_sfnt_off000128f0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x128F0 11796 bytes
SHA-256: d0ac4f83f62e4dc5b8cfd5a6a42930e1541a666374ee726119db4746b5a9b8e1
font_02_sfnt_off00014fdd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14FDD 4324 bytes
SHA-256: 1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361

Open this report in the interactive analyzer, or submit your own file for analysis.