Malicious PDF — malware analysis report

Static analysis result for SHA-256 f085c57520b33cd2…

MALICIOUS

PDF

75.8 KB Created: 2021-05-11 03:00:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 4ba532e685856eb4c38b665df9695d91 SHA-1: af0d679aed5bd197d5d19d74cea63cca061d2d94 SHA-256: f085c57520b33cd237f0e124d6ab734527df8d483347f113bf0c5410359816c9
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that, when clicked, likely leads to a malicious website. The document body, though heavily obfuscated, appears to be a lure related to a broken appliance, consistent with phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/strik?utm_term=black+and+decker+blower+stopped+working PDF link annotation
    • https://cdn.sqhk.co/mosepoxik/d1otBZ9/keepsafe_applock_fingerprint_password_apk.pdfIn PDF document text
    • https://cdn.sqhk.co/rajunakeb/cJjijcC/kizasakeguteguwiserosivas.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4443342/normal_600dbfc3a8e95.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372100/normal_60413f88ec0f7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375357/normal_5fd787b629304.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4386349/normal_6018549a34dac.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4407318/normal_604165921e953.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/kopisigapub/zifozajanopid.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/68a6a959-f5d0-40ee-973c-4f853389b5e7/how_do_i_get_rid_of_my_wine_belly.pdfIn PDF document text
    • https://e4586023-485a-43f1-9451-2d404684c5b7.filesusr.com/ugd/95ff22_ee32f904d67747d68b0e62d66b504d50.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gaxuremewuger/air_force_question_paper_2011_with_answers.pdfIn PDF document text
    • https://c4cd0dbc-23d7-4f11-b65f-2561cec8abe5.filesusr.com/ugd/516793_c160a3b913ba4d5187a556532bc69271.pdf?index=trueIn PDF document text
    • https://a21f0d7d-5fe0-4a99-a381-3b18266e0880.filesusr.com/ugd/6c313a_e6d7a2be7b074723b9039ccbb20c6933.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/nuruvapozixix/matajumanadotuxamaluma.pdfIn PDF document text
    • https://9462281c-6212-45c1-8f90-c4e3c363a226.filesusr.com/ugd/007d40_8d7c95df15dc414dafbc9107268c492d.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/a8694d73-2e6e-41aa-b56f-8bb5ffc2414e/sepaxerelanuteteboras.pdfIn PDF document text
    • https://afa032df-bfad-47da-a9c8-c79260182993.filesusr.com/ugd/6f9b04_881f85a25b5d49ea97a871ee91f4b4d2.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/bivanud/93135140952.pdfIn PDF document text
    • https://4647adb0-9c01-46a1-aef1-4380d5873f13.filesusr.com/ugd/edb4a7_36296a1dbf9a42508bba0b72ac12467b.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/a8134b15-2e83-4e43-86a7-f34a8373d832/nufogusubujavo.pdfIn PDF document text
    • https://s3.amazonaws.com/vuterijoze/zusuwolovorawilufiwowi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea60.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA60 5584 bytes
SHA-256: fb0ea66c734c9eaafdedcbf75068768fec240d6db2482c3d1d53ddd04fba99be
font_01_sfnt_off0000fd7e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD7E 10776 bytes
SHA-256: 5377f10c01095fe6004d52f429e8f6a08a8852a8596b168baa341e6172c5dfc8

Open this report in the interactive analyzer, or submit your own file for analysis.