Malicious PDF — malware analysis report

Static analysis result for SHA-256 f0fb06962c021328…

MALICIOUS

PDF

70.5 KB Created: 2021-04-26 19:52:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 40656c3a9e1025fb5c70cd8a5ed9b122 SHA-1: c37944ed4d4e7c7998637aabf085760e02b6a12a SHA-256: f0fb06962c021328ac3c168ed564c790f924e295177b429b96c47cb28499e370
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ML classification and ClamAV, specifically flagged as Pdf.Phishing.Trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to serve a malicious payload. The presence of a 'download' lure further supports a phishing or social engineering attack vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=quran+translation+in+tagalog+download+pdf PDF link annotation
    • https://cdn.sqhk.co/dewufidabo/iidTFjb/bajaj_boxer_bm_150_service_manual.pdfIn PDF document text
    • https://cdn.sqhk.co/xubupigegi/hi6ifgg/oscar_fish_movie.pdfIn PDF document text
    • https://cdn.sqhk.co/nemuvefik/kjjTuWF/kufixi.pdfIn PDF document text
    • https://cdn.sqhk.co/juvebuzizej/cAXjfjc/9339925661.pdfIn PDF document text
    • https://cdn.sqhk.co/vuzowadijavu/hciagdA/vozusuzidi.pdfIn PDF document text
    • https://cdn.sqhk.co/dijogiper/icjjkib/94531301179.pdfIn PDF document text
    • https://cdn.sqhk.co/lisakopew/jbdjbX8/girlfriend_plus_mod_apk_0._4._5.pdfIn PDF document text
    • https://cdn.sqhk.co/wolanojijen/oBjaPVo/chocolate_covered_strawberries_bouquet_with_roses.pdfIn PDF document text
    • https://cdn.sqhk.co/burexewejam/dcdjhGu/wojna_polsko_bolszewicka_bitwa_warszawska.pdfIn PDF document text
    • https://cdn.sqhk.co/monejipo/jjJahzm/background_image_app.pdfIn PDF document text
    • https://cdn.sqhk.co/xojoweva/eZRgitL/44199211440.pdfIn PDF document text
    • https://cdn.sqhk.co/vaminika/MwI0hcd/academy_awards_2021_cancelled.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/fejififimaketo/13997056224.pdfIn PDF document text
    • https://s3.amazonaws.com/xedewofuretujo/fogizesarejopewipa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4e261660-a770-4587-878c-1b3642e9827f/what_does_the_0.05_level_of_significance_mean.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bdc40b84-eed5-4fee-8815-fcffdfebc44d/on_writing_well_william_zinsser_quotes.pdfIn PDF document text
    • https://s3.amazonaws.com/sukobogixe/fuwufe.pdfIn PDF document text
    • https://s3.amazonaws.com/tobaziw/album_bozorg_vol_2.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/289a0794-bab5-4ae1-98c3-65b5095c907c/11053110522.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bd434021-e0e7-4a39-852e-6f530ad31085/zafajasusotufon.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0a1bed0d-e4d5-438b-b54c-44a949369035/clockwork_prince_series.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/01191355-d2db-453c-8289-ee9639f714a1/self_introduction_sample_for_job_interview_experience.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2695a930-32ad-4e63-a143-edca37b82cc2/optical_fiber_communication_john_m_senior_solution_manual.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d6e4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD6E4 5360 bytes
SHA-256: 7e1c155cefa5e45a20b8268aa285a25adf10be0700496b6b26274a4d7232d57d
font_01_sfnt_off0000e93f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE93F 10212 bytes
SHA-256: 7367162730765cdc3ff15cade04171387bf2c1d8429463615c8bdd558cc20ddf

Open this report in the interactive analyzer, or submit your own file for analysis.