Malicious PDF — malware analysis report

Static analysis result for SHA-256 bbfde79913724a07…

MALICIOUS

PDF

82.3 KB Created: 2021-10-16 05:22:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)
MD5: 672d297b6353efe52bade9417a97cc6d SHA-1: 2ff0c3d5a2e3ddbe52a620f6f7ecb2677f4bf833 SHA-256: bbfde79913724a07fadb458eaf0fe319dcaeac46334ac3dedeb8b80676953cd5
174 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript and a high-severity heuristic firing for a PDF link to an algorithmically-generated URL, indicating a phishing attempt. ClamAV also detected this file as Pdf.Phishing.Trojan. The embedded JavaScript and the link likely serve to download and execute a second-stage payload, consistent with a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9977

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kanomax-nsk.ru/images/vozepo.pdf
    • https://xetnghiemadndanang.com/upload/userfiles/files/26865595240.pdf
    • http://nguyenphat.com/public/default/ckeditor/files/tibalawitevodog.pdf
    • http://rpsbchamber.org/editorData/file/45372289961.pdf
    • http://uptownherndon.com/uploads/files/xusigufabis.pdf
    • http://ozdermusavirlik.net/userfiles/file/girevoworebiwiw.pdf
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614b2b3a9bf90---pusuxiki.pdf
    • http://novafish.it/userfiles/files/47381794367.pdf
    • https://qualitycountscleaning.com/wp-content/plugins/super-forms/uploads/php/files/ed3a57f9277ccb91be5511a4c836a185/donumegamaxuwim.pdf
    • https://okinawa4d.com/contents/files/1911295317.pdf
    • http://doudou.tw/userfiles/files/99241516495.pdf
    • https://elpollopaulino.com/cenavarra_userfiles/files/99515957370.pdf
    • http://kaizousha.com/js/upload/files/64926099290.pdf
    • https://www.esfa.bg/root/ckfinder/userfiles/files/winimorubaz.pdf
    • http://berallebags.com/UploadFiles/FCKeditor/20211001204414.pdf
    • http://yourhealthyanswer.com/ckfinder/userfiles/files/83645484650.pdf
    • http://sentezetutmerkezi.com/upload/ckfinder/files/wapexujabifemameluxuxed.pdf
    • http://cosmeticdermatologymiamibeach.com/uploads/data/files/muniwavavikubozuletasul.pdf
    • https://otdelkamos.ru/wp-content/plugins/super-forms/uploads/php/files/eaf7ff9f3c22203e1053cb69a657d00e/lelujatexoj.pdf
    • http://pro-group.ru/userfiles/files/19862572299.pdf
    • http://www.sunarnuricomuisvealisverismerkezi.com/wp-content/plugins/super-forms/uploads/php/files/8romvrah9a72838vilrnqaneo5/jemebedozuzuxodumukuvusuj.pdf
    • http://obkladlazby.cz/userfiles/file/pezidusevuweku.pdf
    • https://devisme.maxtis.com/userfiles/file/55182098975.pdf
    • https://feedproxy.google.com/~r/Gsjc/~3/TSvcnjQ06Jg/uplcv?utm_term=be+an+advocate
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de93.bin
9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDE93 16792 bytes
font_01_sfnt_off0000f6a5.bin
cfded614585bf5d98a2ebbaddd454e920302f1a8f8e47aa5367a757c5ce6d9a3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF6A5 18084 bytes
font_02_sfnt_off00012541.bin
712e7340b04b00353da01920de094639c447e72bcf4322f965de4a97401fe419		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12541 10076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.