Malicious PDF — malware analysis report

Static analysis result for SHA-256 04db50128137288f…

MALICIOUS

PDF

108.7 KB Created: 2021-04-03 14:34:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 0205d4c5e06da6c366557ae8cc35d0c7 SHA-1: da5e7d5b1057996b193c67dfd22490e7e1f18ce3 SHA-256: 04db50128137288f39cf567913dc2f237f16f78c592bd0d22e9ee6519a474da4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=how+do+i+setup+my+linksys+ac1200+boost+ex PDF link annotation
    • http://obuv-kozha.ru/study_of_human_intelligence_cognitive_psychologyux62d.pdfIn PDF document text
    • http://vostokzapad.su/wixuxasudoxojibawip2dqib.pdfIn PDF document text
    • http://shtancircul.site/77884438248pvvt5.pdfIn PDF document text
    • http://about-central.com/75313527200lulb7.pdfIn PDF document text
    • http://parhelifrl.space/motorola_sbg6580_setup_without_cd01sle.pdfIn PDF document text
    • http://shimano-stradic.ru/dj_coffin_dance_meme_astronomia_coffin21xxe.pdfIn PDF document text
    • https://cdn.sqhk.co/raninogozo/84jdiij/metal_earth_3d_puzzles.pdfIn PDF document text
    • https://cdn.sqhk.co/zevukodixu/Wibrifk/guess_the_movie_game_emoji.pdfIn PDF document text
    • http://jakartapro.xyz/oxford_handbook_of_cardiology_frclra1.pdfIn PDF document text
    • https://cdn.sqhk.co/jakufomego/KaigeWB/detafogipukux.pdfIn PDF document text
    • http://nesobaka9.xyz/a_raisin_in_the_sun_charactersrrger.pdfIn PDF document text
    • http://teaapple.space/erven_diplom_upollzyto.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xirixepo/make_avr_programming_github.pdfIn PDF document text
    • https://f039f7e9-c7fa-441d-bf3d-2f0e35d6be10.filesusr.com/ugd/80685d_62cd1817c3f548e680d75ee43c9483fa.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zemigiduwagafu/cookbook_free_download.pdfIn PDF document text
    • https://21e323bd-7fdd-46e9-a6c7-4880e76d7610.filesusr.com/ugd/0a51c1_8f1cc949ac85495c988265d3dc0ae0a0.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xokebore/john_deere_gator_hpx_aftermarket_parts.pdfIn PDF document text
    • https://a62e46b8-d933-4087-892c-e5439cec6991.filesusr.com/ugd/e9cba9_9929267d258b4fb1881594322ca46378.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/mipizaju/78322378884.pdfIn PDF document text
    • https://s3.amazonaws.com/perurulexi/lexinebulebediduwolorobax.pdfIn PDF document text
    • https://c18d7360-3707-4bf1-9d6f-52ba7510fa17.filesusr.com/ugd/76cb06_830a13552b6c4cc48f6bd8f87152f77f.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000165de.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x165DE 5876 bytes
SHA-256: e559c7864ba852e6cc5c837b26e70591d2d06a6a4cf8fdd60bc1994cec6560b9
font_01_sfnt_off000179e6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x179E6 12420 bytes
SHA-256: 84b45e0378d32c6cd06dd100ddd6b04923f095fe57110606a28b5d4bb7cd2447

Open this report in the interactive analyzer, or submit your own file for analysis.