Malicious PDF — malware analysis report

Static analysis result for SHA-256 f33dc04b909c3a51…

MALICIOUS

PDF

77.6 KB Created: 2021-03-25 09:43:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 50e636714e306dde8cc8ca5da1b83ff2 SHA-1: 923c2474507fe2a7b5165171dcfce25c58ce7219 SHA-256: f33dc04b909c3a51a9264af012acf345002b1630a060221a8065ae3773d2cac9
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple suspicious links, including one to 'securitycheckingbrowservkcom.xyz', which is likely part of a phishing or malware distribution scheme. The presence of a ClamAV detection for 'Pdf.Phishing.Trojan' and ML classifier flagging further supports its malicious nature. The document body, though heavily corrupted, contains keywords related to cracked software, suggesting a lure for potentially malicious downloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-heavy PDF with invisible link to suspicious domain high PDF_SUSPICIOUS_LINK_LURE
    PDF is a small image-heavy lure with invisible link annotations that send the user to a suspicious high-risk-domain URI. This matches credential-phishing carriers where the visible document is only a prompt and the real collection flow happens on the linked website.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=photoshop+cc+cracked+reddit
    • http://jixuvofariva.iblogger.org/salary_expectations_answer_examples_uk.pdf
    • http://securitycheckingbrowservkcom.xyz/47096649340moljn.pdf
    • http://stankovit.ru/gopro_silver_4_manualgrf50.pdf
    • http://xodakarefadivag.iblogger.org/australian_keto_meals.pdf
    • https://cdn-cms.f-static.net/uploads/4383577/normal_6014e3905d83e.pdf
    • https://static.s123-cdn-static.com/uploads/4418963/normal_5ff9fe77eb5e7.pdf
    • https://cdn-cms.f-static.net/uploads/4417519/normal_602aac6a90286.pdf
    • http://kosixanadiguf.iblogger.org/zizanovogoziwiza.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://6363ce23-9394-4102-a476-7be320345719.filesusr.com/ugd/7c41c1_e600ef2a534c40008509dbd65244e5a4.pdf?index=true
    • https://7c5e2310-e79b-429e-9f4a-70471a43dcce.filesusr.com/ugd/8ec1ef_370aa7cd87164b539156d9fcd583eecb.pdf?index=true
    • https://feedbc21-cb93-402c-9ae2-3476589645d2.filesusr.com/ugd/f3ecbe_e1da5ac0078a43ed80cee2b014279ce8.pdf?index=true
    • http://wonitijaxexilo.rf.gd/tp_link_router_wr841n_password.pdf
    • https://07e0a16e-b77d-475b-b724-88bbaedb347c.filesusr.com/ugd/8e9e2f_0abda079ea9c41de8e57fcac2367e947.pdf?index=true
    • http://petenufafevut.rf.gd/topographic_survey_report.pdf
    • https://291e86d0-b4b7-455e-aeca-30cd05102b29.filesusr.com/ugd/384a46_21b88c39a7f44e2eb1f668e96160e094.pdf?index=true
    • http://folilef.rf.gd/25968793368.pdf
    • http://safefimij.epizy.com/year_3_science_worksheets_free_uk.pdf
    • http://jojixeme.rf.gd/extent_reports_latest_version_maven_dependency.pdf
    • http://tinasixubu.epizy.com/11691994699.pdf
    • http://fonajuwowo.epizy.com/james_bond_theme_music_piano_sheet.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e77f.bin
40b5face7643b830bcaf6955d485755244820cab23f63f19852cded4cd77bcb5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE77F 4876 bytes
font_01_sfnt_off0000f822.bin
9b7ae0778fdc674cbae6e1544b93116094bef608ccb892b14b6a09302d315874		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF822 10244 bytes
font_02_sfnt_off00011b3b.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11B3B 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.