Malicious PDF — malware analysis report

Static analysis result for SHA-256 028edcb2f90ca265…

MALICIOUS

PDF

77.9 KB Created: 2021-03-14 03:51:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f70e8f693305c40b7df743592cc84608 SHA-1: 5fa86b21e540075136791527c493bb59b4c25c9e SHA-256: 028edcb2f90ca265cfcccd38035c18adab07b94af22ef830075c0774567b5737
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, vilenefex.ru, which is likely part of a phishing campaign. The document body, though heavily obfuscated, suggests a lure related to educational content to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/123?utm_term=khan+academy+challenge+sequels+in+sql+answers
    • http://lady-bug.club/wafafitavoboxet1t9il.pdf
    • http://creditscoreusa.info/epson_precisioncore_workforce_wf-3640_not_printing2fwhs.pdf
    • http://zumanidoxup.medianewsonline.com/judezutamozarewugi.pdf
    • http://filanion.online/52376968518lm153.pdf
    • http://sellforce.ru/38870690997xh5o5.pdf
    • https://cdn.sqhk.co/tatakakuwito/HhfBiVw/java._lang._outofmemoryerror_permgen_space_tomcat_8._5.pdf
    • http://50off.pro/mukaguxoboxasejebasnb9z.pdf
    • http://thiswaytovogue.com/adding_fraction_worksheet_tess9k7z.pdf
    • http://bella24.xyz/pijodunufipuvofiyr57s.pdf
    • http://tonedomopoja.scienceontheweb.net/can_a_highlander_hybrid_tow_a_trailer.pdf
    • http://babubusawase.22web.org/cartesian_dualism_mind_body.pdf
    • http://rutenowataba.iblogger.org/xofubagefulujavaw.pdf
    • http://zirisumiwuxi.iblogger.org/abordaje_pterional.pdf
    • http://roflan.site/32132078847a9y07.pdf
    • https://cdn.sqhk.co/tajiwikiter/ibBhiOS/70142251006.pdf
    • https://cdn.sqhk.co/sebudesusoj/vdpPgfz/line_camera_photo_editor_free_download.pdf
    • http://x-bionic.shop/11614910943pueyl.pdf
    • http://expressvpn.store/gugikoregugebitesekubotux0bgzl.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://ff0b3df2-dc61-4aeb-9024-93fa9b5bc175.filesusr.com/ugd/aa14a9_ecce329ad4fb43578b4e106623ace345.pdf?index=true
    • http://kaxuwenewutexu.myartsonline.com/am_communications_salary.pdf
    • http://wegajovekesowor.epizy.com/crc_white_lithium_grease_sds_sheets.pdf
    • http://rosajeku.myartsonline.com/what_can_you_do_with_a_molecular_biology_degree.pdf
    • https://6b2f37ea-3696-4b87-858b-663c379f6f6f.filesusr.com/ugd/16879a_33e528d1d755479e8e212902d3e91f79.pdf?index=true
    • https://edb7bb8d-792a-4213-93ec-7f573d37cc74.filesusr.com/ugd/bfd504_48160bf7f1fc4f8f852858fed7eeb53b.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eccd.bin
7324fe6d0348977b87633c5e4b58dd47428de0e05c4f65da74e7aa0be2ca9b27		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECCD 5644 bytes
font_01_sfnt_off0000ffe4.bin
6b604b60bf1852e4e8dfb033ed4f5998325757eb6ed705f01bb7a18f967b65b7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFFE4 13040 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.