Malicious PDF — malware analysis report

Static analysis result for SHA-256 04e1df3d0d0634f6…

MALICIOUS

PDF

77.6 KB Created: 2021-04-16 19:40:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 213fd687bee29b2d6965449146ac92ed SHA-1: a34d8f1029afe62f73803b29c191143346e5f059 SHA-256: 04e1df3d0d0634f62ab146ef7b1645cf6ed54e3ce360e0ed9858c89743d50572
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a suspicious domain. The ML classifier and ClamAV detection strongly indicate maliciousness. The document body, though partially corrupted, suggests a lure related to a hardware manual, likely to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=asus+m5a78l-m+lx+plus+manual
    • https://cdn-cms.f-static.net/uploads/4485800/normal_6036655591551.pdf
    • http://topsol.xyz/bifatirogidifomezejm42dw.pdf
    • https://static.s123-cdn-static.com/uploads/4428078/normal_5fce4d776612d.pdf
    • https://static.s123-cdn-static.com/uploads/4420764/normal_5ff9de82cc7af.pdf
    • http://zexejodubaxiku.mygamesonline.org/2020_19_boston_celtics_schedule.pdf
    • http://avtoshkola-region26.ru/yono_lite_sbi_mobile_banking_apkk33zg.pdf
    • https://static.s123-cdn-static.com/uploads/4477655/normal_60061c1bdf0f0.pdf
    • http://inscarusa.info/how_to_get_free_karaoke_songs_for_singing_machine2mm69.pdf
    • https://static.s123-cdn-static.com/uploads/4443804/normal_5feba297d23af.pdf
    • http://elerctum.org/luxiwidoralijgmfwx.pdf
    • http://topcreditcheck.info/57444562158siwvy.pdf
    • https://cdn-cms.f-static.net/uploads/4458827/normal_6010ae281ab36.pdf
    • https://cdn-cms.f-static.net/uploads/4370071/normal_600cbc528fcf3.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/bulolimepol/69344785825.pdf
    • https://77047a80-9f17-4504-a563-a097c25ca12e.filesusr.com/ugd/5c8b2f_a0ad2593983149e391d490e9bd62bcfd.pdf?index=true
    • https://c30b87d5-e38e-4f4c-8f61-e356d9eaafe8.filesusr.com/ugd/347120_10499cf4a115417aae34a8d4d1ffebdf.pdf?index=true
    • https://s3.amazonaws.com/zemunomipazikez/fadosusevefemixun.pdf
    • https://8c56b32b-3398-45d6-9c0b-b55146621f16.filesusr.com/ugd/6924eb_81463546a0f44735bc9f04cb34ed5d67.pdf?index=true
    • http://teluroluxeterez.myartsonline.com/61964427458.pdf
    • https://s3.amazonaws.com/pajeriramal/does_royal_mail_deliver_internationally.pdf
    • https://36071b1a-d853-4ad1-bccf-0ed894d94038.filesusr.com/ugd/906e9f_504f704087ef49c9b7a7c6fb88381c6f.pdf?index=true
    • https://s3.amazonaws.com/rutufokedizon/fomakaloxedesekukog.pdf
    • https://s3.amazonaws.com/juduk/kofazorexubabezepegi.pdf
    • https://94e55d9a-ad7c-4b6b-a54a-a00202ad3087.filesusr.com/ugd/208fd7_4add233824934b49b19d262322e53373.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eeb2.bin
6128fbefe3c8f7634ecf47cf093f2e3e951d1a33401f226fa5e8bce86d559c89		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEEB2 5356 bytes
font_01_sfnt_off000100ef.bin
3b894746526eee2e020d37a8f29ddb55280ecf684b83177cb5b788e5c7656ed9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100EF 11888 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.