Malicious PDF — malware analysis report

Static analysis result for SHA-256 f975ff770d0ce97b…

MALICIOUS

PDF

82.3 KB Created: 2021-05-12 07:07:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1eaa0100da3b54d70f4e053384b59d18 SHA-1: dbf33c731ea4f59dfe99399ac918d6cd629aac1f SHA-256: f975ff770d0ce97b64660548d165d523bd0eeebcb6cf7fe1da8c01ed2d88661e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a suspicious domain. ClamAV detection and ML classification strongly indicate malicious intent, specifically identified as a phishing trojan. The document body, though heavily obfuscated, appears to be related to search result content, suggesting a lure to trick users into visiting the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=hoover+steamvac+carpet+cleaner+how+to+use+hand+tool
    • https://cdn-cms.f-static.net/uploads/4451212/normal_5fd6980fc66a8.pdf
    • https://static.s123-cdn-static.com/uploads/4458840/normal_5fdecd7a3fecc.pdf
    • http://subbellassecret.com/laxukolasibexejakusugogasxmsie.pdf
    • http://christinaanddavid2019.com/pipe_welding_man_hour_calculation_excel4wz8g.pdf
    • http://simekavo.22web.org/75109996543.pdf
    • http://menbp.online/how_to_reset_my_overhead_garage_door_opener3jges.pdf
    • http://womovenum.sportsontheweb.net/potid.pdf
    • http://sale50.pro/sermones_adventistas_en_power_point_para_predicarsbwq5.pdf
    • http://widawizo.iblogger.org/92660578813.pdf
    • https://cdn.sqhk.co/doginifa/heC5Qxu/microsoft_powerpoint_slideshows_and_presentations_online.pdf
    • https://cdn.sqhk.co/nefakovuwot/hSjhaic/carvel_ice_cream_cake_meme.pdf
    • https://cdn.sqhk.co/tosobulig/gbVXdJk/siberian_cat_hypoallergenic_for_sale.pdf
    • http://kojazunupetip.mygamesonline.org/love_dare_book_free.pdf
    • http://nncucuucuc.space/citizen_gn-4w-s_set_time3grq2.pdf
    • https://static.s123-cdn-static.com/uploads/4454170/normal_600207940ad12.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://wobanunep.myartsonline.com/sjogren_s_syndrome_pathophysiology.pdf
    • https://uploads.strikinglycdn.com/files/2764a1ed-8e79-4e86-8bf4-a7f4f4392c87/how_to_check_codes_on_polaris_sportsman_450.pdf
    • http://zeduxutebepirob.epizy.com/knee_pain_exercises_spanish.pdf
    • https://uploads.strikinglycdn.com/files/78734f55-429e-4d8a-a8e8-e44cc4b70096/83368397409.pdf
    • http://jefiferinazubim.atwebpages.com/multiplication_and_division_integers_worksheet_with_answers.pdf
    • http://xonelamurojili.rf.gd/toro_ccr_2000_snowblower_carburetor_adjustment.pdf
    • http://bivojeda.atwebpages.com/7125796693.pdf
    • https://uploads.strikinglycdn.com/files/0221a249-4d4a-4bcf-ba48-b94d62cda172/how_do_you_say_sunrise_in_spanish.pdf
    • http://duposul.epizy.com/pulufedexaz.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000102bf.bin
ecaa798c44b74b1e3cb00ef54529bd46c0a49137f8801b10bcd2a348368dbc82		 pdf-font-stream PDF embedded font (sfnt) at offset 0x102BF 5424 bytes
font_01_sfnt_off00011516.bin
a2187675fda88687af6660948bce63027a1dc2f9881098ec671045a34b271389		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11516 11260 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.