Malicious PDF — malware analysis report

Static analysis result for SHA-256 fbce66f3271afae0…

MALICIOUS

PDF

80.0 KB Created: 2021-05-13 20:13:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bd647f248fdc0e026b8be7cfa3a52964 SHA-1: 29b52e803dd5943755a5a09079c255873ac89ef9 SHA-256: fbce66f3271afae0fbe1836e159db72dfb36f52c2bbf9a3b1d1c1bfd4e143ba0
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site. The document body, though heavily obfuscated, appears to be a lure related to a story, suggesting a phishing or social engineering attempt. No scripts were extracted, but the presence of external URLs and the overall detection profile indicate a malicious intent to compromise the user.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9946

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=the+fisherman+and+his+wife+story+pdf
    • http://sberbank.link/how_to_reset_sanyo_remote_control05066.pdf
    • https://wezawemexa.weebly.com/uploads/1/3/1/4/131410399/5006159.pdf
    • http://arbitestpark.xyz/49154476892u06pg.pdf
    • https://juvivufoli.weebly.com/uploads/1/3/5/3/135325295/9624420.pdf
    • https://juviroxekeko.weebly.com/uploads/1/3/5/3/135399696/7c740bcd6ea9d6.pdf
    • http://dsv-trening.ru/8727296170206iyl.pdf
    • http://edaruzal.xyz/133534502269tqqc.pdf
    • https://lujonojezim.weebly.com/uploads/1/3/4/5/134588784/melevusir.pdf
    • https://xitorudabetibom.weebly.com/uploads/1/3/1/8/131856365/kexepukas_woxegoxidijiko_kuwizedubod.pdf
    • https://pazovazorukilaz.weebly.com/uploads/1/3/4/6/134673506/3240332.pdf
    • https://xojumemusip.weebly.com/uploads/1/3/4/0/134018475/5179c307187ac30.pdf
    • https://buzolemego.weebly.com/uploads/1/3/5/3/135393469/wikuzisasus_jinarol.pdf
    • http://viputixezererej.66ghz.com/madres_solas_pilar_cernuda.pdf
    • https://fenonurel.weebly.com/uploads/1/3/1/1/131164034/c4a87e635c28.pdf
    • http://loleveze.iblogger.org/rolling_contact_bearing_nptel.pdf
    • http://tasefile.22web.org/99059811953.pdf
    • http://freshremont.com/buoyancy_example_problems_with_solutionshux49.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://sejanufejos.epizy.com/39415076974.pdf
    • https://uploads.strikinglycdn.com/files/d4095e79-0135-40ff-9e90-2cdc3e989e65/how_to_draw_a_person_on_procreate_easy.pdf
    • http://lepiwapugu.rf.gd/81486988955.pdf
    • https://uploads.strikinglycdn.com/files/a6b9c577-54d6-4659-8726-8fcd459bb3db/how_to_disassemble_a_smart_trike.pdf
    • https://s3.amazonaws.com/fumiposamisur/sekerikutiziladob.pdf
    • https://s3.amazonaws.com/diwitapezu/income_eligibility_guidelines_for_medicaid_in_ny.pdf
    • https://s3.amazonaws.com/minabiwa/42263013407.pdf
    • https://uploads.strikinglycdn.com/files/7450a775-92d1-4ea4-8b48-37e59f2d63c8/good_books_to_read_for_ninth_graders.pdf
    • https://uploads.strikinglycdn.com/files/6cba6cb6-883c-4bde-b1c3-638857e21208/5573252226.pdf
    • https://uploads.strikinglycdn.com/files/8caef613-94c9-4b05-939d-e2b81375e192/padi_open_water_diver_final_exam_questions.pdf
    • https://s3.amazonaws.com/pulavokaxe/99_names_of_allah_with_benefits_in_urdu.pdf
    • https://s3.amazonaws.com/belopudevuzuza/pifixepetunafuj.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef40.bin
a7f483b9e7f90f3f9ff8a7d6b1366dd6aff8b8c1cd816fcba5a1665d9d61443f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF40 5180 bytes
font_01_sfnt_off000100ca.bin
050004a1ddd5061987069db4c1c9b7e693faf2480d6d32cc075c928da2b6d77a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100CA 10040 bytes
font_02_sfnt_off0001230c.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1230C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.