Malicious PDF — malware analysis report

Static analysis result for SHA-256 feb44a91cb1a4fbb…

MALICIOUS

PDF

78.4 KB Created: 2021-02-24 17:56:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: b8ccd8e9198381e773e02462a107d11e SHA-1: dc547796c2af1c1ad9c00e8d9926f103585bc961 SHA-256: feb44a91cb1a4fbb5c8c9384a6ba93b78d05d4c54a645391f4376de2c4c17e47
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a suspicious domain, masquerading as a search result for a specific PDF document. The ML classifier and ClamAV detection strongly indicate malicious intent, likely phishing or malware distribution. While no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/strik?utm_term=hanuman+chalisa+in+kannada+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4484618/normal_602ee69edf647.pdfIn PDF document text
    • http://sparzha.club/netters_anatomy_coloring_book_answer_keyvgj5g.pdfIn PDF document text
    • http://lovechat24.club/metal_slug_3_xbox_360_backwards_compatibilityexqc9.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://s3.amazonaws.com/tinivukedeta/formal_definition_of_antipathy.pdfIn PDF document text
    • https://s3.amazonaws.com/babetafaperaxov/google_spreadsheet_script_for_loop.pdfIn PDF document text
    • https://s3.amazonaws.com/tapexiw/boondocks_gang_rieng.pdfIn PDF document text
    • https://s3.amazonaws.com/ximupuv/laxarebawutipazem.pdfIn PDF document text
    • https://s3.amazonaws.com/gumegulaxi/chiari_malformation_pillow_uk.pdfIn PDF document text
    • https://s3.amazonaws.com/vokeri/74769104837.pdfIn PDF document text
    • https://s3.amazonaws.com/tuzakifezara/it_clown_meme_template.pdfIn PDF document text
    • https://s3.amazonaws.com/tutasujal/vovuli.pdfIn PDF document text
    • https://s3.amazonaws.com/mejados/v_for_vendetta_graphic_novel_hardcover.pdfIn PDF document text
    • https://s3.amazonaws.com/fajetufekejo/lettering_practice_sheet.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d43d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD43D 4900 bytes
SHA-256: 371345392699040890f866f713f409ff89914131f54a05394a3022b7246c8856
font_01_sfnt_off0000e4a0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE4A0 3772 bytes
SHA-256: 240b01ea4caa45f57f54ab4d6d5eb6187b906162b2682bc4dcfb9155b206388d
font_02_sfnt_off0000f045.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF045 9740 bytes
SHA-256: 8addd691609003990f9c7e892b9b4f20793607182a81248e13d20449a990c90c
font_03_sfnt_off000111c2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x111C2 4324 bytes
SHA-256: 7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71
font_04_sfnt_off00011fc2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11FC2 2572 bytes
SHA-256: 1391a2ce8e86a81dcea1ae520600e968aca936d467c2ae9fc3edb515ffe6ff09

Open this report in the interactive analyzer, or submit your own file for analysis.