Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6984f4567e4e2a8…

MALICIOUS

PDF

162.9 KB Created: 2021-05-07 01:44:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: b6d670480e319f72cac8d039c3774ba3 SHA-1: d933321375c2dec3092460a85d199581a61d4fbd SHA-256: f6984f4567e4e2a890798fa75c3c4d878a065e8920e185acdfda1dbc26946473
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains an external URI pointing to a suspicious domain, which is likely part of a phishing lure. The document body, though heavily corrupted, appears to be related to a search query for a PDF download, reinforcing the phishing pretext.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9964

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/strik?utm_term=vishnu+sahasranamam+meaning+in+telugu+pdf+download PDF link annotation
    • https://cdn.sqhk.co/sofetarunox/d4VJgfD/grand_truck_simulator.pdfIn PDF document text
    • https://cdn.sqhk.co/mafowixodi/c1gdJjg/41426302569.pdfIn PDF document text
    • https://cdn.sqhk.co/fezavomol/fsmhjgc/90549952267.pdfIn PDF document text
    • https://cdn.sqhk.co/jirudumom/f84f6Jx/easy_milkshake_recipe_without_milk.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/fba75f4b-5ddb-4aa2-ba95-482f2d05978e/definition_of_flowchart_in_computer_language.pdfIn PDF document text
    • https://s3.amazonaws.com/wowonesoribu/18867822749.pdfIn PDF document text
    • https://s3.amazonaws.com/foneniz/gazebigokodotakeguju.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dd3f85fb-a698-4fc8-bca9-a6afe4431940/63370530481.pdfIn PDF document text
    • https://s3.amazonaws.com/lewuli/galodozajiwe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9e432e1e-6a79-4810-85e1-49ca0e50f245/is_vizio_tv_good_for_gaming.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/32d9b6cd-826e-4f33-abe7-68e856af6639/sekixaloviwemu.pdfIn PDF document text
    • https://d4e73f68-9870-4c81-be0c-0a6dd7607cd2.filesusr.com/ugd/6f53d7_d8e80454f88d4151a004b93775d27b53.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jemisajoda/cnbc_personal_finance_reporter.pdfIn PDF document text
    • https://s3.amazonaws.com/batoragubukepo/marevojuzig.pdfIn PDF document text
    • https://d6b7b3c7-8429-4d82-9d75-5d5d09e763cc.filesusr.com/ugd/a8c229_b14d6a97ff464b44a6c62cc8112483ba.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tarajix/why_is_my_dell_not_turning_on.pdfIn PDF document text
    • https://s3.amazonaws.com/xoferuzu/pidajidixivi.pdfIn PDF document text
    • https://s3.amazonaws.com/donarepemi/josokavojuno.pdfIn PDF document text
    • https://s3.amazonaws.com/remuv/cowboys_vs_jets_injury_report.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eb49c07e-82f9-4b28-8626-55c574492a07/bibekoziwaretaroxale.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8996e1b5-51b8-40fa-becf-031f8bb80da1/perfect_progressive_tense_worksheet_with_answers.pdfIn PDF document text
    • https://6ec3981f-6443-463b-a164-91fc69f101d9.filesusr.com/ugd/7603ae_e78810a3e77749748c2f90975c795133.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00019d1c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19D1C 5396 bytes
SHA-256: 3bac497f9fdd54c24e6ef25b229e2814c17137fe8a3e122d940b4c5fb1e3a9c8
font_01_sfnt_off0001af4e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1AF4E 3772 bytes
SHA-256: b850e935aaf604f3e1824861b6c46746957ce6d0e1401f4bf16d070b42224529
font_02_sfnt_off0001baf0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1BAF0 85628 bytes
SHA-256: aa6ec168df5ad50352b1a2f4055e56770b0b6179570bb474997a4b01fa1d107b
font_03_sfnt_off00024daf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x24DAF 9756 bytes
SHA-256: 7630b8327acab4eb122b76a412cf745ff467c0783fae9a431872e54629dbc7f0
font_04_sfnt_off00026ee1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x26EE1 4324 bytes
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3

Open this report in the interactive analyzer, or submit your own file for analysis.