Malicious PDF — malware analysis report

Static analysis result for SHA-256 f3648690cfa81048…

MALICIOUS

PDF

75.2 KB Created: 2021-03-27 22:45:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 661b115fc5f2e4f8a7fb18ffd4ce9202 SHA-1: d99dec43a425c6766e20ba40823655b1482733f0 SHA-256: f3648690cfa81048991721e99b8e3d282c9ba3dacf598eaaabc351a45bce5376
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. The document body, though partially obfuscated, suggests a lure related to 'source analysis questions', which is a common tactic for phishing or social engineering.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wix?keyword=how+to+answer+a+source+analysis+question
    • https://vupagujisixo.weebly.com/uploads/1/3/4/9/134904753/totepofatafa-gamukowimanufid-rewazukij.pdf
    • https://jefamiwufilidiv.weebly.com/uploads/1/3/1/4/131409158/631c0.pdf
    • http://b4shop.icu/kikagajar8psnx.pdf
    • http://kamikofonem.mygamesonline.org/miller_symmetry_groups_and_their_applications.pdf
    • http://tapidiv.medianewsonline.com/suzakikabuvivonivadavoli.pdf
    • http://pofuxubilet.sportsontheweb.net/bacterial_dna_replication.pdf
    • http://kemutedetabu.scienceontheweb.net/bloomers_pattern.pdf
    • http://golixudib.mypressonline.com/fenuberavug.pdf
    • http://serarudipiwuvon.mypressonline.com/alkanes_alkenes_alkynes.pdf
    • https://wivikomale.weebly.com/uploads/1/3/2/7/132740486/854658.pdf
    • http://pixunune.sportsontheweb.net/alternative_investment_strategies.pdf
    • http://the-english-temple.com/el_nombre_de_la_rosa_pelicula_completa_en_espaol_youtubex9weu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/9ab61a57-8244-409b-97e2-e9cf089c2fe8/webudekokupopamidofepa.pdf
    • https://e2604e0b-f95a-4acb-b53f-a7db3827b2a1.filesusr.com/ugd/225520_fa862ce8aa424b9fb48e6b2cf21741d2.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b9c40b5a-1b64-40a5-9f50-5dbba438ef2d/kofamepokukoxibevulori.pdf
    • https://c779a0a5-5a96-4308-8c37-720837e0bdd2.filesusr.com/ugd/4f1d02_089dc3fb1270467ba247adbd9cae2f18.pdf?index=true
    • https://uploads.strikinglycdn.com/files/f1632f50-a4dd-4548-857c-4b819ffa4a5e/think_of_me_phantom_of_the_opera_piano.pdf
    • https://uploads.strikinglycdn.com/files/e657e6bc-97da-44fe-bc48-aaf29a118e16/39936877605.pdf
    • http://ketabigumowun.atwebpages.com/52882410862.pdf
    • https://uploads.strikinglycdn.com/files/3e16be9a-3933-4056-b8ce-bfb4e032fbfe/why_has_my_kitchen_extractor_fan_stopped_working.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e98b.bin
dfa1224ce2d9211237dbbcc74184e052be49c16d4e3dfdb68062f3eb47c71a24		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE98B 5076 bytes
font_01_sfnt_off0000faf7.bin
154d9777c6001464e65ab36927842074aeffbd1c70d88a9bfb7a6bfbe541d10e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFAF7 10752 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.