Malicious PDF — malware analysis report

Static analysis result for SHA-256 f691561d145ff830…

MALICIOUS

PDF

77.7 KB Created: 2021-05-06 10:20:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ccd0bc33066305b6c5741f7d8c74839b SHA-1: 261e1b1b41a294ee881b2d2566a9817c6d288cfa SHA-256: f691561d145ff830477d6733b383b9155cebfd657265aaf096f7886813af2ce5
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains embedded URLs that point to other PDF files, suggesting a phishing or credential harvesting attempt. The document body, though heavily obfuscated, appears to reference driver downloads, a common lure for malware distribution. No scripts were extracted, but the presence of external URIs and the overall detection profile indicate a phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.yoursurveysurveyors.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/16083c7cd01165---15783032218.pdf
    • http://www.appsolutely.sg/wp-content/plugins/formcraft/file-upload/server/content/files/1606d23798cd51---93198563057.pdf
    • https://atlastoursntravels.com/userfiles/file/fifetuwowokijoxulu.pdf
    • https://visaonline-vn.com/wp-content/plugins/super-forms/uploads/php/files/bdmndggkmncvao6fq8dtleut6l/gaxixebapebojimomalimoda.pdf
    • http://jtour.vn/userfiles/file/viraroronono.pdf
    • https://aquaticlandscape.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607657ccd7052---jenolituzemovafirelupawag.pdf
    • http://www.publicitymailing.ie/wp-content/plugins/formcraft/file-upload/server/content/files/16071de52374f5---sapinusujiv.pdf
    • https://brandonsmilesdentistry.com/wp-content/plugins/super-forms/uploads/php/files/r8tvna52i9b4psm341ec220f75/linaloxutogudi.pdf
    • https://gaseg.com/wp-content/plugins/super-forms/uploads/php/files/iejisod87chkl5ldolgheo7dg6/tivizavefilezafomo.pdf
    • http://astro2sphere.com/admin/images/file/70139000511.pdf
    • http://africansafaris-spain.com/FCKeditor/editor/filemanager/connectors/php/connector.php?Command=FileUpload&Type=File&CurrentFolder=%252Ffile/womugaxufifuxafane.pdf
    • http://philippinesroadshow.com/wp-content/plugins/super-forms/uploads/php/files/dc2622e43ba4bd1af41760e8840e5691/77720167487.pdf
    • https://adbadog.com/wp-content/plugins/super-forms/uploads/php/files/c53e4e50a55099ae324db42fb6d0f215/90093484926.pdf
    • http://www.webtony.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160752a39db8d8---lozotuluvujiwa.pdf
    • http://www.playerclub.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1606ee8c775f62---56989933974.pdf
    • http://ats-dz.com/userfiles/file/jogebejifofenorawosedib.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://feedproxy.google.com/~r/Uplcv/~3/GLLx1DTH0VQ/uplcv?utm_term=behringer+x32+asio+driver
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f51a.bin
a406284e121daa2e782e8390cc8e8cffc10291b78c9a2d16ceeee4c5e23c144a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF51A 5528 bytes
font_01_sfnt_off000107e8.bin
86c9c6e0279306f88f7a9e0e564ad1cca116ba529e2b4ede34196f803914845c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x107E8 10420 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.