Malicious PDF — malware analysis report

Static analysis result for SHA-256 037ce4fc9257d834…

MALICIOUS

PDF

87.2 KB Created: 2021-03-20 12:11:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7f18d198f2413b708993254dabb6130a SHA-1: 19002c4a196adc3e80e63fddc7ae874f54cbd5f6 SHA-256: 037ce4fc9257d8346cf2507ad071c8b17aa66f078bc230e68f71082bd0f1d84b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. It contains an embedded URI pointing to 'https://xezojetit.ru/strik?utm_term=que+es+el+derecho+civil+pdf', which is likely a phishing lure or a distribution point for further malicious content. The document body, though heavily obfuscated, suggests a theme related to civil law, further supporting a phishing or social engineering pretext.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=que+es+el+derecho+civil+pdf
    • http://supermagazforsale1.xyz/52610551747pyx6y.pdf
    • http://konsalting.info/gopro_hero3_update_instructions0mfkw.pdf
    • https://static.s123-cdn-static.com/uploads/4461766/normal_6000bd714fd83.pdf
    • http://zoradiwa.iblogger.org/sejibizafowot.pdf
    • http://radasekot.iblogger.org/wigapirizewoxolelotax.pdf
    • https://static.s123-cdn-static.com/uploads/4385028/normal_5fdd90d37485e.pdf
    • https://static.s123-cdn-static.com/uploads/4380090/normal_5ff68c6775649.pdf
    • http://thecet.xyz/132316014291ey1o.pdf
    • http://affilateapp.online/l_amant_de_la_chine_du_nordegays.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/zafaronivaj/how_much_is_daymond_john_net_worth.pdf
    • http://vixasipa.rf.gd/siwebogew.pdf
    • https://s3.amazonaws.com/kiwopusafize/skype_launcher_7._18.pdf
    • https://uploads.strikinglycdn.com/files/483f65b0-736a-4e1d-b4fd-e60a1da1f303/the_dark_tower_the_gunslinger_born.pdf
    • https://s3.amazonaws.com/dudigonifu/midet.pdf
    • https://uploads.strikinglycdn.com/files/39d5222d-11f7-4eb7-bcad-55ec70b64fb2/running_strides_for_beginners.pdf
    • http://mijekew.epizy.com/fl_studio_11_guide.pdf
    • https://uploads.strikinglycdn.com/files/5de88e6e-ce82-4e71-a624-a2cdbfc3d693/la_crosse_technology_bc700-cbp_alpha_power_battery_charger.pdf
    • http://lijulipewagikev.rf.gd/edamame_beans_nutritional_information.pdf
    • http://kogiwosewa.rf.gd/fundamentals_of_economics.pdf
    • http://taxifegizuni.epizy.com/61232153840.pdf
    • http://kidereludabiron.epizy.com/56442224974.pdf
    • https://uploads.strikinglycdn.com/files/8b507ddd-44a0-4690-a16f-5844aadf7058/60425613513.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010690.bin
9c1d8dd25879e7b97a81aa1b8c433c873963ebc5bd2455b8117c18525ee83529		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10690 4852 bytes
font_01_sfnt_off00011722.bin
39828fdda97d011690487f3e5af1a31ff176a22fb48720af8a17146bc13aed5d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11722 12704 bytes
font_02_sfnt_off0001400a.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1400A 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.