Malicious PDF — malware analysis report

Static analysis result for SHA-256 0474a635a680e911…

MALICIOUS

PDF

77.8 KB Created: 2021-04-28 06:51:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b79f829d6a3ff8f5de0905809140d5d1 SHA-1: 2422b4817b4a2852d5fba00abd7ebd131bbce864 SHA-256: 0474a635a680e911ebe0ed59a763d838fbe41e58df57fea6a219029833643473
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that likely serves as a lure for users to download a malicious payload, disguised as a 'food safety standards book pdf'. The presence of embedded URLs and the nature of the detection suggest a phishing attack aimed at delivering malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=food+safety+standards+book+pdf
    • http://winsl.space/depapabaduvirawusedexomefxh3t9.pdf
    • http://ukranews.icu/matowujuvisejapuviwixpx5ya.pdf
    • http://cmb-accueil.com/can_you_use_bluetooth_with_roku9uxc9.pdf
    • http://7lessons.fun/xodemadupekeyebcm.pdf
    • http://dexiwakuxabef.medianewsonline.com/carcinoma_thyroid.pdf
    • http://women-ita.space/zarafojokarowanu6n705.pdf
    • http://resimpub.com/the_exorcist_book763vt.pdf
    • http://devlp.design/43396219815ninx.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://65de77fc-0341-4fd2-89b2-cd6b005a91de.filesusr.com/ugd/cf79db_a36ee411a563420cb8e757007fff57da.pdf?index=true
    • http://laxukumelukadut.myartsonline.com/aerial_photography_book.pdf
    • http://godusisoti.onlinewebshop.net/at_last_sheet_music.pdf
    • https://0e8f88b9-656e-4b05-9cd8-8bd477f85547.filesusr.com/ugd/95b9ea_f1aff62681124f41a8c5681784a1e46f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/1b87dac0-6761-4c6b-9a2a-b3f7e9b96598/list_of_greek_gods_and_goddesses_names_and_their_powers.pdf
    • https://uploads.strikinglycdn.com/files/7aa397bf-e8c4-4ba8-a958-4c0e35bb8de5/vudipa.pdf
    • https://8f0c9b82-9570-4081-bbb7-5e23a534ea09.filesusr.com/ugd/7008f3_f86fcfe57bdc4f64abdbeddef86a033c.pdf?index=true
    • https://uploads.strikinglycdn.com/files/d11d0ef0-f2fc-4e4c-a907-f4bc316c66cc/yamaha_mg124cx_for_sale.pdf
    • http://lumalidik.atwebpages.com/circle_of_fifths_scales.pdf
    • https://26f2e344-8444-46ea-90c9-5a893bcc2fb3.filesusr.com/ugd/b8c837_689c0b7380794304a9a4bd74e2b0eadc.pdf?index=true
    • https://s3.amazonaws.com/wozowuledij/auld_lang_syne_lyrics_pentatonix.pdf
    • https://84d5b3ab-51dd-4312-87b7-51df18fb3b26.filesusr.com/ugd/9ea9b6_8e87161d625845bc9035fbd2116737c7.pdf?index=true
    • https://s3.amazonaws.com/polojuliragam/the_adventures_of_huckleberry_finn_imagery.pdf
    • https://s3.amazonaws.com/laradusa/reliance_annual_report_2018-_19.pdf
    • https://medlineplus.gov/foodsafety.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f367.bin
778776ece106c4943042f41464a77d960c0d40b2f155b9d13bf66aa4abb960f7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF367 5264 bytes
font_01_sfnt_off00010567.bin
cb244d976d5d01c3f455170a88905cf4f45aef2ee87aa1a4eb07cde43cccca6b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10567 10808 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.