Malicious PDF — malware analysis report

Static analysis result for SHA-256 fa7c62ba0379934c…

MALICIOUS

PDF

78.0 KB Created: 2021-03-21 09:31:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cb99ed4ce045ad7d2d328940fdd5deec SHA-1: 5b9f69c5791fdfa46b10df529e4abb6cde2b846f SHA-256: fa7c62ba0379934c8f1e080ff227b6db2e2e2fb08b7932e5bece08ee600cfc00
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to deliver a malicious payload or redirect the user to a phishing site. The document body, though heavily obfuscated, contains text related to 'Faringitis viral pdf' and the wkhtmltopdf application, suggesting a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/award?keyword=faringitis+viral+pdf
    • http://novazeku.mygamesonline.org/oxford_picture_dictionary_third_edition_english_spanish_dictionary.pdf
    • http://bivebojulop.iblogger.org/how_to_become_certified_internal_auditor_philippines.pdf
    • http://fukuzowi.sportsontheweb.net/43463820413.pdf
    • http://degunoneb.iblogger.org/23029241068.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/1e81733f-cb9f-439d-8df5-6b6c4fe8698f/tenergy_lipo_charger_manual.pdf
    • http://xulufavuso.rf.gd/baghban_full_movie_free.pdf
    • https://29aa9d28-cc9d-45fc-8d86-3718b5881c84.filesusr.com/ugd/74c34a_16eb51b1f0d24eecb34bb04b7e7459ed.pdf?index=true
    • https://7abbf572-6989-4614-8246-9d5ba34cd238.filesusr.com/ugd/af841b_33b1be6463a8429492c7b3b9abb749c2.pdf?index=true
    • http://vonizevugopu.rf.gd/vibagofibigenumox.pdf
    • https://34e51215-b586-4e01-b3ea-a219475a7b91.filesusr.com/ugd/46481b_6d98ed090ea7406b87a43b781387b9f0.pdf?index=true
    • https://uploads.strikinglycdn.com/files/fa715c5d-1098-4b7e-bcac-b1b5641c2083/what_size_should_a_football_pitch_be.pdf
    • http://kapodos.rf.gd/manualidades_con_madera_paso_a_paso.pdf
    • https://488c2ff9-9ff4-499e-8f11-525115e20b22.filesusr.com/ugd/8aba0c_70ee2977e72b48478548478987ca7df6.pdf?index=true
    • http://mafevokok.rf.gd/pezokix.pdf
    • https://uploads.strikinglycdn.com/files/d008e118-087e-4f69-8f96-5761aa6a2689/kukevanunelate.pdf
    • https://3f9320ff-391d-49df-b192-c557e211a93c.filesusr.com/ugd/469aea_14b836907ecf49d6ae10f36277a0d0e2.pdf?index=true
    • http://ketabigumowun.atwebpages.com/how_to_start_civil_court_proceedings.pdf
    • https://uploads.strikinglycdn.com/files/255a5b20-f086-4681-97fe-750c9e9563de/is_the_book_in_a_dark_dark_wood_a_movie.pdf
    • https://cc67bef4-e22e-42fd-bf01-3f02b15f800b.filesusr.com/ugd/080020_5d47e3c08f7f44be92e6a7a3baabea86.pdf?index=true
    • https://6a24fdd2-d4a5-4c4b-882b-0f3115751bcf.filesusr.com/ugd/04e6f9_9edd4aadf47c46eca5e75842c1374563.pdf?index=true
    • http://zaxefexagafiri.epizy.com/10988528157.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3f2.bin
71a48917a20ff3674b7d8f56fd958db0a51f85e15c6916ab205b00ada86dc968		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF3F2 5224 bytes
font_01_sfnt_off000105d4.bin
25309109ebc198b8e29f73bf6275fd551f1fa4b4c048da7a517954d6220ee2d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x105D4 10968 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.