Malicious PDF — malware analysis report

Static analysis result for SHA-256 0510613f30d9e22a…

MALICIOUS

PDF

176.2 KB Created: 2021-03-10 06:12:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 82ca4cbc9920052f8750842f546332ca SHA-1: 17d62fdc03944f2d0d76f1efa36bad8230f2e6cb SHA-256: 0510613f30d9e22a711ce147f03bcdaf9b78cb478d9a6fe1db18cf5eea0b6114
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains an embedded URI pointing to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, appears to be a lure related to 'Immanuel Kant critique of pure reason pdf', suggesting a phishing or social engineering attempt to drive users to the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9986

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=immanuel+kant+critique+of+pure+reason+pdf
    • https://cdn-cms.f-static.net/uploads/4422908/normal_6021f81c901f6.pdf
    • http://fuzubijixulux.mygamesonline.org/jawir.pdf
    • http://kakolamilasaru.medianewsonline.com/how_much_does_corian_cost_compared_to_granite.pdf
    • https://lemapemoj.weebly.com/uploads/1/3/4/0/134040436/6b2ea22a1.pdf
    • https://fitepavi.weebly.com/uploads/1/3/4/4/134485464/taxovatefu_wugar_nolekugejazaxo_gidavaj.pdf
    • http://knitfqph.site/suwisegegizexuneto5c05g.pdf
    • http://urro-hu.com/sample_of_works_cited_page_mla_formatb2b2m.pdf
    • https://kazowotamije.weebly.com/uploads/1/3/4/0/134012594/1887017.pdf
    • https://static.s123-cdn-static.com/uploads/4444875/normal_5ff5d72f767e7.pdf
    • http://lazirog.mywebcommunity.org/save_the_cat_writes_a_novel_epub_free.pdf
    • https://kotuposa.weebly.com/uploads/1/3/1/4/131406283/wojilijaxadolobogobu.pdf
    • http://tiktokfrance.fun/aberdeen_group_contract_management_benchmark_reportmmsgf.pdf
    • https://gasomuvujutomeb.weebly.com/uploads/1/3/4/3/134356107/subovafege-kofosisizukopem-zured.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/rumezo/cacti_template_windows_server_2016.pdf
    • https://72cdfa97-b5fe-44cc-9aa9-3142b5aa642a.filesusr.com/ugd/ee32c9_b6e407a89f1048df8d8fa95cac9530ca.pdf?index=true
    • https://s3.amazonaws.com/fivebo/how_many_types_of_sap_courses_are_there.pdf
    • https://ec679cc6-872a-45a8-b2fd-b1bc8f6ddb77.filesusr.com/ugd/d1d005_fe3bc7c67f464c95b92c3df8dd5a092b.pdf?index=true
    • https://s3.amazonaws.com/tubukeganuji/33614297435.pdf
    • https://299bc67c-4c9a-44ea-852c-18f2d39dca40.filesusr.com/ugd/954c8b_0d3dc83a925744d483aec1b3f783411b.pdf?index=true
    • https://75a697d3-84f0-44cf-bab9-f05e37020c50.filesusr.com/ugd/7c3584_5d1c0da5ece748b5a3ddeffd3a782565.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off00026f71.bin
2a6c57a0323052f6e2e93f8fa2f8b49df658b94a27a6da9def45b9f9d77b9a26		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x26F71 30212 bytes
font_00_sfnt_off00023407.bin
0a5c5afe719a80043da5d9b1a9191e6ed178502acf4bd005de3b1c9f7cbd6bf0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x23407 5312 bytes
font_01_sfnt_off000245ee.bin
a18341bcfeac0139f7e84f48e46e1262d1fd76d5cf72c5fb6dbe7d557606a619		 pdf-font-stream PDF embedded font (sfnt) at offset 0x245EE 12744 bytes
font_03_sfnt_off0002a453.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2A453 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.