Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe03434c26214b04…

MALICIOUS

PDF

77.9 KB Created: 2021-03-19 09:41:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 78ee42e9bfba0362dc4abe02bf2771f4 SHA-1: d61decfda42fba0ff7bf08feccf8426c335018c3 SHA-256: fe03434c26214b041169329ebc82480d56ae7c53ce9aaad8a08c5131e8e20a4f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by a ML classifier and ClamAV, indicating a high likelihood of malicious intent. The PDF contains an embedded URI pointing to a suspicious domain, likely intended for phishing or malware distribution. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site, aligning with spearphishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/aws?utm_term=the+landlady+story+theme
    • http://zereteleriw.getenjoyment.net/mamiya_rb67_pro_sd_back.pdf
    • https://cdn.sqhk.co/wazafanez/rDVCIha/stickman_falling_download.pdf
    • https://cdn-cms.f-static.net/uploads/4468871/normal_5fe73084a8b68.pdf
    • http://wumomotetidofe.getenjoyment.net/vuxareribivotomepimuz.pdf
    • https://cdn-cms.f-static.net/uploads/4471723/normal_6014aaeecedff.pdf
    • https://cdn-cms.f-static.net/uploads/4374203/normal_602a19623a8a5.pdf
    • https://cdn.sqhk.co/mazonixun/HbQ10jj/gusebex.pdf
    • https://cdn-cms.f-static.net/uploads/4417662/normal_6036cdf8b6d82.pdf
    • https://static.s123-cdn-static.com/uploads/4499636/normal_5fce20d078685.pdf
    • https://cdn.sqhk.co/nedabuke/g9hd5jg/74903958344.pdf
    • https://cdn.sqhk.co/sabimejuka/hc4RBgg/snapchat_can_t_login_connection_error.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/1db337cd-dbd7-4695-a5d4-4262e57ed0d4/what_is_a_smart_call.pdf
    • https://uploads.strikinglycdn.com/files/d40f1ce8-a776-40c9-a88c-825a871aa3aa/what_is_exposition_in_plot_diagram.pdf
    • https://uploads.strikinglycdn.com/files/fea4198b-1b0c-4afa-8e91-a55c491a5ecd/51849716040.pdf
    • https://uploads.strikinglycdn.com/files/ff32c746-9134-4e1c-8492-07315c21baef/instructions_for_descaling_keurig_2.0_with_vinegar.pdf
    • https://uploads.strikinglycdn.com/files/d9d236f0-455c-48e6-812a-db09a0b5fd5e/xbox_360_eject_button.pdf
    • https://uploads.strikinglycdn.com/files/b6e0af6e-1ec5-4e3b-a540-7f434dd956f1/85542254309.pdf
    • https://uploads.strikinglycdn.com/files/35873aba-b394-44a0-8e66-ab810b76343d/64933295065.pdf
    • https://uploads.strikinglycdn.com/files/e291215e-937f-4846-8184-2e455e15334f/jadawatew.pdf
    • https://uploads.strikinglycdn.com/files/fabb9be7-7327-4fb9-b342-3ad20d408b74/gufagiretutifolunoj.pdf
    • https://uploads.strikinglycdn.com/files/392a7f3c-d557-4151-9428-077365f88cd8/the_summer_is_gone_and_all_the_roses_falling.pdf
    • https://uploads.strikinglycdn.com/files/1bee7482-f13f-445b-a784-c6164d1335f9/dukagewidatem.pdf
    • https://uploads.strikinglycdn.com/files/e6fb1a41-80bb-4972-820e-71c3abc33bd4/app_for_solving_mathematical_problems.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f467.bin
212644dd4656f5396471feab83840d3eb171094ea7e555ccb7ed8dc537721de0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF467 5116 bytes
font_01_sfnt_off000105a9.bin
3965e37fd59389f024204a8fd873c3ba0cbcbd12d78292483df531dbfbdf8b9d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x105A9 10696 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.