Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc25efca72c4f1da…

MALICIOUS

PDF

85.6 KB Created: 2021-03-27 14:14:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2ea51da7a8628d27d3f6ac6fe0e5710b SHA-1: 2c30e3813d6bc8fa3c675ec60568816b545dc38c SHA-256: fc25efca72c4f1da2dfc6c23fffec20bb4d706ca626b9a4ebf2bacc84bb2843f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware download site. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest it's designed to exploit users through deceptive content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=fender+super+champ+x2+parts
    • https://cdn.sqhk.co/fogibadeku/eZoG3AK/modern_air_power_tips.pdf
    • http://form-copyrightservices.com/the_pledge_of_allegiance_in_spanish7ach0.pdf
    • http://bitjoms.xyz/kuwavakajamilafinafikopatmkwyy.pdf
    • https://cdn.sqhk.co/tufuboloruj/klhfhjz/honda_accord_transmission_fluid_change_how_often.pdf
    • https://cdn.sqhk.co/vomisape/hiyJ6Ke/amazon_robots_warehouse_jobs.pdf
    • http://dalkomis.website/legends_survival_battleground_apkpure2xufd.pdf
    • https://static.s123-cdn-static.com/uploads/4417818/normal_6008e207ec929.pdf
    • https://cdn.sqhk.co/nasonamav/SIVPTEn/rusk_deep_shine_conditioner_platinum.pdf
    • https://cdn-cms.f-static.net/uploads/4413983/normal_60595ddd94a74.pdf
    • https://cdn-cms.f-static.net/uploads/4427105/normal_604cdef558afb.pdf
    • https://cdn.sqhk.co/jeporikate/j5ejf8C/21660221547.pdf
    • https://cdn.sqhk.co/dasisogi/jh4haNm/36638821886.pdf
    • https://cdn.sqhk.co/zaliroded/hhc7Phh/granny_s_house_online_mod_menu_apk.pdf
    • https://cdn.sqhk.co/baresupujar/11ihL6R/dj_remix_nonstop_offline_2020_mp3_download.pdf
    • https://static.s123-cdn-static.com/uploads/4483864/normal_6007a8dbe532b.pdf
    • http://nextauto02.ru/school_emergency_information_card_templateotyy8.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/fotepopunaj/the_theatre_experience_13th_edition.pdf
    • https://s3.amazonaws.com/fifuto/zumukemebutexixaralaw.pdf
    • https://s3.amazonaws.com/mujevubutukoxu/djihadiste_francais_reportage.pdf
    • https://s3.amazonaws.com/xozeb/el_alquimista_libro_en_ingles.pdf
    • https://s3.amazonaws.com/jolituzoji/capture_one_12_guide.pdf
    • https://s3.amazonaws.com/suxuzubojut/kenmore_70_series_heavy_duty_washer_parts.pdf
    • https://s3.amazonaws.com/fizufapu/surviving_the_dust_bowl_video_answers.pdf
    • https://s3.amazonaws.com/libusamagowuvo/zodiac_jandy_aquapure_plc1400_plc1400_salt_water_cell.pdf
    • https://s3.amazonaws.com/tuletivotarupu/formal_letter_to_consulate_template.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb20.bin
faa0153ff2be553550d42ac57a5e40615f77035eee90344fdd1b391fccecbf5d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB20 5436 bytes
font_01_sfnt_off00010d7b.bin
75460625f917eabeb0c0a90f9750a333360159d0aaa1d8b5ce581fc964772ab9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D7B 10524 bytes
font_02_sfnt_off000131d7.bin
e93acd332f5893643511f4cefd38969ad5c744ad1b08842a788b6be7d277dd15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x131D7 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.