Malicious PDF — malware analysis report

Static analysis result for SHA-256 075d135cb3768e29…

MALICIOUS

PDF

83.6 KB Created: 2021-03-27 22:13:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 23b7d9b4a6b51ebde5967b6010deddb3 SHA-1: d878de631942e3f07f40c471a07f1b3d5010c0e5 SHA-256: 075d135cb3768e2903896d2e244783f89f0226c7617484274481968b7c9a377e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a suspicious domain, identified by heuristics as a potential phishing attempt. The ML classifier and ClamAV detection strongly indicate maliciousness, classifying it as a phishing trojan. The document body, though heavily obfuscated, contains text related to a medical device manual, likely serving as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/wix?keyword=masimo+set+rainbow+pulse+oximeter+manual
    • https://cdn.sqhk.co/nezotelo/gjhggii/mafia_gangster_street_crime_city_mod_apk.pdf
    • https://cdn.sqhk.co/mirofifuba/iiYDdib/carnivores_dinosaur_hunter_reborn_download.pdf
    • https://cdn-cms.f-static.net/uploads/4407327/normal_603161326c49c.pdf
    • https://zizovotitimojuv.weebly.com/uploads/1/3/2/7/132712514/torogavin-sugexopiber-wegokejobapi-fonizasar.pdf
    • https://cdn-cms.f-static.net/uploads/4390371/normal_601f0e462e8ea.pdf
    • https://taruzalo.weebly.com/uploads/1/3/5/3/135398133/foxogasosapudimuvu.pdf
    • http://fc-aromat.ru/bose_soundtouch_10_manual_englishgpn4u.pdf
    • https://cdn-cms.f-static.net/uploads/4446034/normal_605a92c7c40ef.pdf
    • https://cdn.sqhk.co/dokukavifig/jbii4RP/15188672958.pdf
    • http://iminn.ru/39513839225i5o2j.pdf
    • http://igcopyrightclient.com/20473572749sjvkk.pdf
    • https://cdn.sqhk.co/sarunasol/2qgdKdJ/99339717349.pdf
    • http://avto-trokot.xyz/peketubarulolujebatubiwof2b091.pdf
    • https://cdn.sqhk.co/bapuwanuvadi/Z8sfiih/age_of_empires_ottoman_strategy.pdf
    • https://static.s123-cdn-static.com/uploads/4406775/normal_5feb0e53c99de.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/tiduro/union_budget_2018_highlights.pdf
    • https://63995da9-74be-4895-8497-a4fa53c9845d.filesusr.com/ugd/788c84_4f356b270329489685d27e7e9152637c.pdf?index=true
    • https://7fe1f042-206b-4735-a408-f56337efeeb4.filesusr.com/ugd/d34b51_ee9c7f7ccc2244d49ef144362697f372.pdf?index=true
    • https://s3.amazonaws.com/bolovopizonuki/68515861948.pdf
    • https://s3.amazonaws.com/vovuzize/sort_excel_spreadsheet_by_column.pdf
    • https://8ca15cf9-c5bf-4329-906a-32df3c7b5ab7.filesusr.com/ugd/4ca7f5_a3027e9f0e1444c6904e90af5d0e82d5.pdf?index=true
    • https://e1318bff-d970-45e2-bcea-45481503a18b.filesusr.com/ugd/75a96d_d6a3f1c3606b487cbe3046bd9d04cdf2.pdf?index=true
    • https://s3.amazonaws.com/fovezewi/welch_allyn_spot_vital_signs_lxi_how_to_set_date_and_time.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000104a3.bin
7d1fdb49336c6289b1f71e8c0ff515c76e40006ee6943cb4b5eb80bfba9a1ba3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104A3 5268 bytes
font_01_sfnt_off00011695.bin
4de0a875c7381b9fee36e5eaa370468f9426911130b7a620928583a62983d68a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11695 12108 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.