Malicious PDF — malware analysis report

Static analysis result for SHA-256 f7273417c7ccb2d3…

MALICIOUS

PDF

71.3 KB Created: 2021-02-04 05:06:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: d472c156a75a7f581570d873f784985d SHA-1: f57e4fac05cea84cce7264623555a9e104f917bc SHA-256: f7273417c7ccb2d3c33ca32beab763b8f59cf1cf99996ef0b56382fe391553ef
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a URL that appears to be a lure for downloading software, suggesting a phishing or malware distribution scheme. While no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a phishing attempt to trick users into downloading unwanted or malicious files.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wb?keyword=ashampoo%20photo%20optimizer%203 PDF link annotation
    • https://cdn.sqhk.co/wafexumu/dU1FWrP/castle_defender_premium_hero_idle_defense_td_apk.pdfIn PDF document text
    • https://cdn.sqhk.co/fusevesapime/ojaMghe/world_sports_events_august.pdfIn PDF document text
    • https://cdn.sqhk.co/wibononuve/jhghejg/91586970926.pdfIn PDF document text
    • http://wownatural.fun/pijoxarudiwomusq68um.pdfIn PDF document text
    • http://idealicaitalia-official.site/shooting_range_battle_creek1v9jv.pdfIn PDF document text
    • https://cdn.sqhk.co/jivonotiso/1jhfhcm/gif_live_wallpaper_iphone.pdfIn PDF document text
    • https://cdn.sqhk.co/nizekidido/AjbzjiO/nipirozu.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4421623/normal_5feb63460a89d.pdfIn PDF document text
    • https://cdn.sqhk.co/bobimugura/gs8Yid2/audiotool_app_for_mac.pdfIn PDF document text
    • http://itasda.online/apollo_635_636_gate_opener_manualdc0ww.pdfIn PDF document text
    • https://cdn.sqhk.co/nixivezez/djj0mgc/68390158895.pdfIn PDF document text
    • https://cdn.sqhk.co/telivagawu/GCifjgA/sudoku_online_easy_unblocked.pdfIn PDF document text
    • http://casbah2point0.com/bypass_samsung_account_apk_freegp4rh.pdfIn PDF document text
    • https://cdn.sqhk.co/tivinarafuvu/zm7jg8w/78017654861.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jivala/top_20_punjabi_songs_2018_audio.pdfIn PDF document text
    • https://s3.amazonaws.com/fipijife/67972811118.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000da61.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDA61 5232 bytes
SHA-256: b40e5116cb3e6b61ba6fcb5af6da805fa301d64f7dc24330e44378b51926beec
font_01_sfnt_off0000ec0e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC0E 10940 bytes
SHA-256: f5cb9ecbfa580628f364a7bbbbb16d7f4a6011b360a05568d0e75f63da8d6a83

Open this report in the interactive analyzer, or submit your own file for analysis.