Malicious PDF — malware analysis report

Static analysis result for SHA-256 ff1dd108f1a8aba2…

MALICIOUS

PDF

75.6 KB Created: 2021-04-02 13:29:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 549407171f04d04959c5727c89c0552a SHA-1: 9de4ef56886ca176641875a6ea57ba885caa7807 SHA-256: ff1dd108f1a8aba25932dda34fcb7fb1afb2d06a2eeae795558e3a17ad32f406
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that mimics a search result for 'mountain bike stickers nz', likely intended to trick the user into clicking it. No scripts were extracted, but the PDF structure and embedded URI indicate a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=mountain+bike+stickers+nz
    • http://linavaluviriv.getenjoyment.net/argumentation_schemes_for_presumptive_reasoning.pdf
    • http://nigavereke.mygamesonline.org/larva_anopheles.pdf
    • https://cdn.sqhk.co/fexiseme/3KwD4ii/element_td_survivor_warcraft_3.pdf
    • http://kimugifogetami.medianewsonline.com/child_and_adolescent_development_reviewer.pdf
    • https://cdn.sqhk.co/pimibopugugo/xicjbHH/best_recipes_using_chocolate_cake_mix.pdf
    • http://rejorevubirobu.sportsontheweb.net/53160749201.pdf
    • http://lebepufu.mypressonline.com/hallelujah_chorus_orchestra_parts.pdf
    • http://juxowupekabaf.mygamesonline.org/ritemakererevewesugokike.pdf
    • http://fafesixokegigi.getenjoyment.net/mecanica_automobilistica.pdf
    • http://viniveba.mywebcommunity.org/clover_pos_system_rates.pdf
    • http://bumawusuka.mypressonline.com/pujenifibatif.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/nuvukivaxiren/ruger_mini_14_side_scope_mount.pdf
    • https://89e1056b-8c01-44a4-bea5-a80a497d444f.filesusr.com/ugd/6db6f7_6fe137387179431eb86d38af44e471a2.pdf?index=true
    • https://3d5b2cfc-74f5-4c02-8466-0d369b02955c.filesusr.com/ugd/69b86f_60ffc66c2c1a4d66ac67c4ca77c6cf7e.pdf?index=true
    • http://makakanow.onlinewebshop.net/volezakos.pdf
    • http://vewawisu.onlinewebshop.net/articulos_cientificos_en_espaol.pdf
    • https://s3.amazonaws.com/gedimuta/deconstructing_common_core_standards_template.pdf
    • http://zisukuvi.atwebpages.com/33017964525.pdf
    • http://gajutar.onlinewebshop.net/fesogedofufudirigupedij.pdf
    • http://lifobem.myartsonline.com/18834277888.pdf
    • https://ed0f7819-48b4-4c0d-9119-93de03d81b9c.filesusr.com/ugd/e481ce_593c8d89571545438333f553723685b2.pdf?index=true
    • https://s3.amazonaws.com/bojafazes/acute_pancreatitis_acg_guidelines.pdf
    • https://ff743420-c5e2-4527-a456-70ddb2a1abd8.filesusr.com/ugd/5178f2_ab33d937f44a4461843d465ffbfb4fec.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ebd3.bin
e5ad0b34c09418b9d417444de5a02db4f438e4978055d12995ea7e1d1ebfe03a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEBD3 5020 bytes
font_01_sfnt_off0000fd0c.bin
bd33551dcdc741b513a9c8c0f5992f3f2e8fde2ae5ee00c09dbe45b466113e06		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD0C 10584 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.