Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd4799b4a974aa18…

MALICIOUS

PDF

84.4 KB Created: 2021-06-29 00:49:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 9772c94bab7f4a0d53f41ee50a08480d SHA-1: 700e215e75f38acf92011ecdcf2a07eaba8e9786 SHA-256: fd4799b4a974aa180d55a72794a05856d19c49f4b4dcd78329d9e65167257b68
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file was identified as malicious by a ClamAV detection and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous embedded URLs pointing to external PDF files, suggesting a phishing or malware distribution campaign. The PDF_URI heuristic specifically highlights an external URI, further supporting this attack pattern. No scripts were extracted, but the presence of multiple suspicious URLs is a strong indicator of malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9964

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://catwalkdogcome.com/editor_upload_image/file/74760875811.pdf
    • http://gialtour.it/themes/userfiles//files/wugivirulav.pdf
    • http://bellezaeimagen.com.mx/wp-content/plugins/formcraft/file-upload/server/content/files/160d264ae1aa0a---21595545112.pdf
    • https://kuechentreff-schmid.de/wp-content/plugins/super-forms/uploads/php/files/11kvdl6lq6bvvbtiqpj7kreqf3/kapuvusexefimopikamif.pdf
    • https://www.cir.cloud/wp-content/plugins/formcraft/file-upload/server/content/files/16089e6035d4ae---97897153750.pdf
    • https://www.temsilcisitesi.com/wp-content/plugins/formcraft/file-upload/server/content/files/160beb1f3cc920---51947036777.pdf
    • http://smit-electronic.hr/upload/datoteke/85717476891.pdf
    • http://luluscafeonline.com/uploads/files/78724302817.pdf
    • https://veglifekc.org/wp-content/plugins/super-forms/uploads/php/files//gosofenato.pdf
    • http://www.fullmooneye.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608ccbcf0873d---wedugujaxo.pdf
    • http://studioego.cz/userfiles/file/71147229185.pdf
    • https://www.landalastadservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/16084f173a4c72---rasib.pdf
    • https://lightingsystemscol.com/wp-content/plugins/super-forms/uploads/php/files/bb8396af96818000503558d1ab0f8f8e/wazaxozapolavesakaw.pdf
    • https://sidexsideaudio.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608a7c72e8b63---bamibewiz.pdf
    • http://modra-skola.cz/userfiles/file/pibuwukezikatoravufuxu.pdf
    • http://pogservice.ru/userfiles/file/sazedokuz.pdf
    • https://www.pal-kont.hu/wp-content/plugins/super-forms/uploads/php/files/bda9ef4ded44bc24689abf76d2b1a135/30497240935.pdf
    • https://amkboiler.com/wp-content/plugins/super-forms/uploads/php/files/habneqgg9dcobflonkt2lpb02h/nuvemebatifoxagegawisuk.pdf
    • http://petersonspann.com/clients/3/32/32c4b2f41fa698b5b938e848169c8dcb/File/dusafaxazujukisomo.pdf
    • http://www.restorationservice.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1607d65de6f61a---sabifuvirinevo.pdf
    • https://drivingschoolofnorthtexas.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083c9842c798---webeximoxof.pdf
    • https://unique.global/wp-content/plugins/super-forms/uploads/php/files/1d4d0c2f3d925f59ac96b2ce484b5252/66834506508.pdf
    • https://feedproxy.google.com/~r/Uplcv/~3/GLLx1DTH0VQ/uplcv?utm_term=lehigh+conference+of+churches
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e49f.bin
ebdca7d0955bae13ecc56d298901680e9b89ce3b87cbf2b8ff1d3af732aa3eb5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE49F 10368 bytes
font_01_sfnt_off0000fbf4.bin
53bb782b7081a4a7bc01e661eef7800b4c7daea062d64a2a01fd3782158cc494		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFBF4 17872 bytes
font_02_sfnt_off00012ac0.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12AC0 16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.