Malicious PDF — malware analysis report

Static analysis result for SHA-256 0376d5accec3b2ca…

MALICIOUS

PDF

75.6 KB Created: 2021-04-05 20:46:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 17dc4e17928166fa3e96759280232f5c SHA-1: 55fd237be948d730117d1a404ad5220c98f6e141 SHA-256: 0376d5accec3b2cabc66809a6cc5ae3fac1853e2dcc019718b68fae8c365858e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL that directs users to a suspicious domain, likely to host a phishing or malware payload. The document body, though heavily obfuscated, appears to be a lure related to sheet music.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=swallowtail+jig+sheet+music+cello
    • http://gutafagiwoja.iblogger.org/75658914319.pdf
    • https://cdn-cms.f-static.net/uploads/4368969/normal_603936af17791.pdf
    • https://cdn-cms.f-static.net/uploads/4459057/normal_6026fd9555529.pdf
    • https://cdn-cms.f-static.net/uploads/4467612/normal_600e48598ff98.pdf
    • https://cdn-cms.f-static.net/uploads/4456984/normal_606ae719b994d.pdf
    • https://static.s123-cdn-static.com/uploads/4428062/normal_5fdfd4dfbea3a.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://kegefuji.epizy.com/nadiwidemef.pdf
    • https://dc6b22d1-fd3c-476a-b8f1-b0505981f591.filesusr.com/ugd/ab5adf_d853098fd6d542289287c95267d8417f.pdf?index=true
    • https://s3.amazonaws.com/tugabijenovili/wiritizupanulifuvofude.pdf
    • https://917ed8d3-8a9f-4c5c-a3ad-554e533308ad.filesusr.com/ugd/a4e402_6fc6a09e43a24a2f87a31231ec569e5e.pdf?index=true
    • http://roxutudutupit.epizy.com/scrum_master_certification_questions_and_answers.pdf
    • https://38c64f87-0506-4925-a3a1-425743e24937.filesusr.com/ugd/386d45_25db1a85024942f0a54eeef3bb3c397f.pdf?index=true
    • https://s3.amazonaws.com/baposivarabuj/4665411616.pdf
    • http://xeleleragakiji.epizy.com/internal_and_external_validity_in_qualitative_research.pdf
    • https://90ff81fc-98d9-4e53-96a3-aaa5c1c2042e.filesusr.com/ugd/bb5aff_15714a2d3b714205b7759460487ac8d2.pdf?index=true
    • http://satuzolo.epizy.com/58919099201.pdf
    • https://s3.amazonaws.com/bovenotojitowe/kedexibupupafanepetatu.pdf
    • http://faretiziko.rf.gd/zalupiras.pdf
    • https://d115d978-d96a-40c8-9764-5d959708fc35.filesusr.com/ugd/436160_175410cb57824551922759ecc297e4d9.pdf?index=true
    • http://morisexisaxewa.epizy.com/zukagomazorejo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db2b.bin
232c9095c7069b763401591bae94ee463e3fdd026a518ad302cabd9543bfe144		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDB2B 5164 bytes
font_01_sfnt_off0000ecce.bin
8d282f6ba810539efc86f5332c8f80d3e4c7911c3e7ccab5987d1143591041ae		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECCE 11072 bytes
font_02_sfnt_off00011291.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11291 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.