Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6a31f022ecf0006…

MALICIOUS

PDF

80.3 KB Created: 2021-03-06 03:57:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fa9b9c362d39b3f4e127e02238b8dd43 SHA-1: 70582308a86cc66cdf5e7ca4a379d56fb8ea8b17 SHA-256: f6a31f022ecf00066d1187d10df13c246f9dec7f81d8231f0dad18171ce8f597
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains an embedded external URL pointing to a suspicious domain, likely intended to host or redirect to a malicious payload. The document body, though partially garbled, suggests a lure related to 'Sharp window air conditioner instructions', which is a common tactic for phishing documents.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/123?utm_term=sharp+window+air+conditioner+instructions
    • http://ig-copyrightnotice.com/67003929790g5099.pdf
    • http://bivodotofa.iblogger.org/city_car_racing_game_for_android.pdf
    • http://magic-spring.com/bedogscklo.pdf
    • http://smcjd.com/hp_officejet_pro_l7680_ink_cartridgesatd7t.pdf
    • http://noxokolozoj.iblogger.org/adobe_reader_9._4_1_free.pdf
    • http://playmarket-online.com/ios_apprentice_8th_edition_download4i4bi.pdf
    • https://cdn.sqhk.co/fefavezevir/XijaAih/black_friday_2020_deals_walmart_tvs.pdf
    • http://electorat.org/libro_de_palacios_derecho_procesal_civill9uff.pdf
    • http://pogadai.xyz/xajiniromonapedokizogutazenm3h.pdf
    • http://fusobilel.iblogger.org/guide_d_installation_armoire_ikea.pdf
    • https://cdn.sqhk.co/livoluxuwad/D2jeibC/live_now_video_call_app_download.pdf
    • http://visiblawty.com/77475284210hfnub.pdf
    • https://cdn.sqhk.co/mekaxosur/bvjdLn9/getty_images_login.pdf
    • https://cdn.sqhk.co/pisomuma/gfihhh8/21736915823.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://7ef5d8b8-74ac-4e0a-b0a0-fa61ca6462a8.filesusr.com/ugd/23e9be_1d71777a15a94f62906beaafed247228.pdf?index=true
    • http://siwomiwededu.epizy.com/pogupotivofonemedusigew.pdf
    • http://rajokawaxes.rf.gd/80703064788.pdf
    • https://s3.amazonaws.com/poguvelefa/ratavukinamu.pdf
    • https://13adc596-845f-4f4a-b539-e2c04a0a4b5a.filesusr.com/ugd/6e2da7_1925f042e68448adaec7e8f9a87ce104.pdf?index=true
    • https://s3.amazonaws.com/sesijesule/striped_bass_fishing_report_cape_cod.pdf
    • https://c81c1a69-aec6-471c-ac34-7a6800eafc69.filesusr.com/ugd/9ef1ea_8a9e01caeb5f421fa0f7b1abf24c0a1e.pdf?index=true
    • https://9cfe8934-cc69-4f76-a0d0-2e9849ea4530.filesusr.com/ugd/fd9558_10dee23884f3465a83a2d2735e59d4d1.pdf?index=true
    • https://s3.amazonaws.com/tesotiwapax/43394338174.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000efbb.bin
416184ac855bd7e8d4bca7d786f53efcbcd14fd91b9a07776887add36800a238		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFBB 5204 bytes
font_01_sfnt_off00010167.bin
b4fd0b58e9f2e24a36e76e242becf6950d597293d8fe8e6c7fac46285033667a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10167 10612 bytes
font_02_sfnt_off0001257e.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1257E 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.