Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd685e285c34a6ee…

MALICIOUS

PDF

73.2 KB Created: 2021-02-25 00:18:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: f8bc12e86b931f4de0904e2ade55c274 SHA-1: 11c2e34ddb2d41ce28bf20cf973dd44ad33bef81 SHA-256: fd685e285c34a6ee55995816b6473d46bc1ea04fd773648871ec95b45fe11cd4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL that leads to a domain known for phishing activities, disguised as a search result. The document body, though heavily obfuscated, appears to be a lure to direct the user to this malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/wb?keyword=what%20problems%20are%20the%20us%20facing%20today PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4490720/normal_6017015371ca3.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4402501/normal_60089cd17c714.pdfIn PDF document text
    • http://sitajejo.22web.org/semikavuwozozunusogod.pdfIn PDF document text
    • https://cdn.sqhk.co/noviraxat/06ie2LM/96869217787.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4486190/normal_5ff81a66d0c27.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4392656/normal_6020fa6a5dde2.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4460473/normal_5fe46b15c5a89.pdfIn PDF document text
    • http://a1metromovers.com/storm_of_swordsquxas.pdfIn PDF document text
    • https://cdn.sqhk.co/gesaxamadew/gd1Rjh4/26883546434.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/rerinago/valkyrie_connect_reroll_guide.pdfIn PDF document text
    • http://setavafajo.epizy.com/basics_of_chess.pdfIn PDF document text
    • https://s3.amazonaws.com/vokeri/everfi_economics_module_1_answers.pdfIn PDF document text
    • http://tufuripisaren.epizy.com/towidag.pdfIn PDF document text
    • http://xuvunemomot.epizy.com/buvefofabipalufivugonibe.pdfIn PDF document text
    • https://s3.amazonaws.com/zeworibuzoza/craftsman_chainsaw_manual_18_42cc_manual.pdfIn PDF document text
    • http://sasugokomelu.rf.gd/calculadora_para_pasar_mililitros_a_gramos.pdfIn PDF document text
    • https://s3.amazonaws.com/kewuxejikiwe/pocket_calculator_font_free.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e1c2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE1C2 5824 bytes
SHA-256: a1e8418b1b57e83674e7169678c2a1614b597ad8f58e9dc5aa9d0614c5c319ad
font_01_sfnt_off0000f57e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF57E 10080 bytes
SHA-256: 307cc4b1c15b9380c1eb3f22dcc2257a2e7b3329b42371d8b18121a7b293a2b2

Open this report in the interactive analyzer, or submit your own file for analysis.