Malicious PDF — malware analysis report

Static analysis result for SHA-256 f86f464a23754dce…

MALICIOUS

PDF

88.8 KB Created: 2021-07-04 21:22:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 36ec29b9e006b9b024d886e0a223b984 SHA-1: 987bde6ceb72c32b8c032fb6734968a978b4db0e SHA-256: f86f464a23754dce235dca22413eb3d55d6754556e7fdab9c02227a610c259d0
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains embedded URLs that redirect to external sites, suggesting a phishing or credential harvesting attempt. The presence of PDF-specific heuristics and embedded URLs points towards a common attack pattern for malicious PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9952

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://irlanc.ru/uplcv?utm_term=advanced+yoga+sequence
    • https://alkhairi.co.uk/wp-content/plugins/super-forms/uploads/php/files/22ecc6dfa2323664aba5d2bac6a4f3e3/fanifonekotuvisopokoj.pdf
    • https://www.chinacimctrailer.com/wp-content/plugins/super-forms/uploads/php/files/01554f6448a3d82ac9e57ae16551c0c5/25654784716.pdf
    • http://3handseg.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d69bb56d607---pirunezek.pdf
    • http://cerezolorente.com/files/cerezolorente/_repo/file/42394828146.pdf
    • https://ceadersvalet.com/wp-content/plugins/formcraft/file-upload/server/content/files/160df425e0f17f---97240925151.pdf
    • https://b2cexpressdemo.com/userfiles/file/vavaxojus.pdf
    • http://chinajessie.com/seadata/data/uploads/img/file/162283576419.pdf
    • http://crystalnymph.by/wp-content/plugins/super-forms/uploads/php/files/a49ac57c293236b8b32f692efcd95ac9/xaxofoxero.pdf
    • http://aeskulap24h.de/wp-content/plugins/formcraft/file-upload/server/content/files/160c1814aed4e1---9766953372.pdf
    • https://www.idromeccanicasrl.com/idromeccanicasrl.com/wp-content/plugins/super-forms/uploads/php/files/22fb5bd0f01548d1973aed9002e28f8e/37862393713.pdf
    • https://radmangroup-ye.com/rgfiles/file/kubaja.pdf
    • https://www.ideaklinikizmir.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607dddb274875---66626426246.pdf
    • https://primeodontorj.com/wp-content/plugins/super-forms/uploads/php/files/73428f6f9c6d7f419e5a22e015813f89/tepelepopowusimezu.pdf
    • https://carthink.org/wp-content/plugins/formcraft/file-upload/server/content/files/160d3d86666c8c---21850980268.pdf
    • http://andlupa.com/userfiles/file/zugapazutetiradepekivevup.pdf
    • http://modnyi-buket.ru/uploads/files/buxab.pdf
    • http://drstevealbrecht.com/wp-content/plugins/super-forms/uploads/php/files/52c3355f018617f69747de53ba136eab/79914057311.pdf
    • http://chretkinia.pl/userfiles/file/24695980394.pdf
    • http://kaplanpm.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ad19b974a1a---wosajasiduf.pdf
    • https://member-amz-seller-system.de/wp-content/plugins/super-forms/uploads/php/files/422512e722e24fe65fcfbdaf63b4bd06/kivijuzetezujo.pdf
    • https://www.areatransfers.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607de9b4b036c---83597081829.pdf
    • https://www.limratechnologies.net/wp-content/plugins/formcraft/file-upload/server/content/files/160b29709ed9ae---65417463752.pdf
    • http://terapie-psi.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1608a9d10d6e20---zuzokagekojaxaretonidilo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f9f0.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9F0 16792 bytes
font_01_sfnt_off00011202.bin
e1eb849e2994ba4890926727c35483483ac3bc1ad1f2dd7cf37e734f1ec270a5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11202 16908 bytes
font_02_sfnt_off00013e33.bin
8ddfa5ede3bc896da858ee94525e41d2ae8c1e6bc9f1f52b57e8e096df3aa710		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13E33 10616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.