Malicious PDF — malware analysis report

Static analysis result for SHA-256 fec8ac2e30687011…

MALICIOUS

PDF

82.8 KB Created: 2020-12-01 21:45:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: ea87b71ed977032abdf0bf61fd1ac1be SHA-1: 189e72ae081283c9aa0e47eb9e104e7877aa7ad9 SHA-256: fec8ac2e306870110b677ff6ae16b0efd0ce95a6a05c619fcbe7119efefb9dd2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. The document body, though partially corrupted, suggests a lure related to health concerns, consistent with phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/strik?utm_term=right+ear+ringing+good+or+bad PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4481831/normal_5fad9fb0ce6ae.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413370/normal_5fad2454c498d.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/72caaea9-0957-41a9-ab34-fda85dced469/gopro_5_manual.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf54214f98375720d72608/1606374436038/browns_valley_mn_newspaper.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b0e67222-738c-4d45-9fd4-caf6e4fe92d5/83147074298.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9790a701-5d0d-4d25-896a-748ec2109557/doperoms_psp_roms.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd1c3931dcc34bf48ed7c9/1606229050448/it_ends_with_us_online.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/80e3f377-81fd-4425-bef6-61fd45edcdc6/75423607791.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/11d9c23c-df25-4799-b948-088d46e5b84b/nhcl_shift_wizard_camp_le.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0de27085bf90c0efce9ba/t/5fc100e5f8cdb769c606705e/1606484197131/no_dog_left_behind_backpack.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf652618e72e5fdbcfc6c5/1606378791652/29813434446.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/608a5ca2-6a46-47d1-8321-347739a1bf2d/error_170_usb_connection_error.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ffad6b61-9129-43ed-9499-d20b0ba0cd04/kexisosa.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f076.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF076 4812 bytes
SHA-256: b792374a5bbfd1a254e017fe5eb7c0cc7e56702442667b5c07da0ba679cfc5bf
font_01_sfnt_off000100bf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x100BF 3720 bytes
SHA-256: 6539b129c5cd894636dc8f40f53a156c00c8f46378ab4f137c96d687a1cff6ed
font_02_sfnt_off00010c22.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10C22 10332 bytes
SHA-256: 6980b50b29f937d4c9527afd5ec5c63ac06763433711e99c3a7ebfb163a308a5
font_03_sfnt_off00012f6c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12F6C 4324 bytes
SHA-256: 1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361

Open this report in the interactive analyzer, or submit your own file for analysis.