Malicious PDF — malware analysis report

Static analysis result for SHA-256 025358f01cf70ece…

MALICIOUS

PDF

82.0 KB Created: 2021-03-18 21:28:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 107c34b00dd037e4e3a6459443ec57f3 SHA-1: 1db0bb21e9525b4823c3bc4fd72e860513186ca8 SHA-256: 025358f01cf70ece18508f767029148f51973a29bc945573208860fb500bc995
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a website impersonating a job recruitment advertisement. This URL is likely used to host a malicious payload or phishing content. The ML classifier and ClamAV detection strongly indicate malicious intent, and the PDF_URI heuristic confirms the presence of an external link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=eve+online+red+frog+freight+recruitment
    • http://vomidujoma.scienceontheweb.net/24878208673.pdf
    • https://static.s123-cdn-static.com/uploads/4456686/normal_5ffa5b814908e.pdf
    • http://muldwych.com/47113430522jxtj2.pdf
    • http://kazimibi.getenjoyment.net/knust_admission_list_2020.pdf
    • https://cdn-cms.f-static.net/uploads/4417222/normal_600a05f63ff70.pdf
    • http://lessonsonline.site/what_is_the_art_description_of_singapore0pakk.pdf
    • http://memisada.mygamesonline.org/cdc_bubble_sheet.pdf
    • http://vinorama.fun/sentence_correction_guide_gmat_manhattann8ht4.pdf
    • https://static.s123-cdn-static.com/uploads/4416514/normal_60063fe338833.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/bolovopizonuki/45421862525.pdf
    • https://s3.amazonaws.com/jefazaxal/tripartite_guidelines_on_term_contract_employees.pdf
    • https://711a90e7-97f2-4eab-8690-3003ec1e9b64.filesusr.com/ugd/a0905b_e2b4d7a124394bc78f3fad19ab41105c.pdf?index=true
    • https://uploads.strikinglycdn.com/files/577c3292-cd43-4773-a707-d34f909adaed/wajeporabidaxelejob.pdf
    • https://4ad55601-b8ab-4ae0-bc0e-e90069072326.filesusr.com/ugd/3aca14_d62d5cbb6fa2435eb9351ac287592541.pdf?index=true
    • https://s3.amazonaws.com/zuvovoxigumuz/63965978783.pdf
    • https://uploads.strikinglycdn.com/files/a14ad331-57b7-4aef-ba52-6ad13d9cd3b5/should_between_be_capitalized_in_a_title.pdf
    • https://4d75d3c9-3a4d-4df6-84ab-e48b83d723e5.filesusr.com/ugd/cdb50c_866527567736414aabcb77e8abf85265.pdf?index=true
    • https://4a0f17ac-6ce6-4c05-9546-25c48d39d9f7.filesusr.com/ugd/cd79e3_434898d07465444795f33567ece63f86.pdf?index=true
    • https://0ea1ff7f-05b3-43a2-9744-178351a05ed1.filesusr.com/ugd/01f9b9_04231a121eaf4c6282cadc91c2b45b06.pdf?index=true
    • https://s3.amazonaws.com/dibedamoka/how_to_view_photos_on_mac.pdf
    • https://uploads.strikinglycdn.com/files/31e8f0e2-798d-4f6b-84f5-02a5e5bba8c8/how_to_charge_lipo_battery_with_imax_b6.pdf
    • https://uploads.strikinglycdn.com/files/fae34d77-2f79-405a-9712-691ea0abf326/notawegawenopakegut.pdf
    • https://uploads.strikinglycdn.com/files/4d5c7662-28b2-4bff-898b-1f097d66ecc0/gamejopuxuwodejibida.pdf
    • http://pidodexogejax.myartsonline.com/berexukafojejovasazisiju.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f750.bin
01e70dd0022b7fbe824afa7afce7ad40ca00428a7545633b8926be5db5d00254		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF750 4948 bytes
font_01_sfnt_off00010801.bin
041523ded2029f33d459b3ac2c9a86fb07433ba71af6b62ea3b222b4926f8eb2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10801 10492 bytes
font_02_sfnt_off00012bf2.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12BF2 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.