Malicious PDF — malware analysis report

Static analysis result for SHA-256 07734a7eb5d3c673…

MALICIOUS

PDF

79.1 KB Created: 2021-03-13 15:55:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 64efb3cd8f620eba19d9c511691b0768 SHA-1: 1a86378e171ceaabd4c271ef000ebb0b49f9140b SHA-256: 07734a7eb5d3c67314e9d732e4b63940e9b6e51a3be84188d435a74751d1f5be
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV with a 'Pdf.Phishing.Trojan' signature. It contains an embedded URI pointing to 'https://xezojetit.ru/award?keyword=backstepping+control+pdf', suggesting a phishing or malware delivery attempt. The document body, though heavily obfuscated, contains metadata related to PDF creation and a keyword that might be used as a lure. No scripts were extracted, but the presence of external URLs and the ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4988

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/award?keyword=backstepping+control+pdf PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4388596/normal_5ff16abd596b0.pdfIn PDF document text
    • http://cashtanks.fun/6342345735w0q7v.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4382790/normal_5ff5acec7a07b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4470699/normal_5ffdd2e97b0db.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4409403/normal_5fdcbe46e65a9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409619/normal_602a251c1dca3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485446/normal_6044d944e7009.pdfIn PDF document text
    • http://kernig.pro/little_red_riding_hood_name_characterskplyb.pdfIn PDF document text
    • http://paksorond.xyz/moto_g6_plus_pattern_unlockrpqn3.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4479917/normal_5fdf3a46c9995.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4450721/normal_5ff445613ddb9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4478928/normal_604972cd7a2ed.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4446170/normal_5fd087349276f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4489853/normal_5fe42657daf3c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4475588/normal_600c5f98205a2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4477638/normal_6026390f3682a.pdfIn PDF document text
    • http://persequen.com/jejovoruwaz99mn.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4408485/normal_6001ca9dd906f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4474220/normal_5fcfeb22829ce.pdfIn PDF document text
    • http://dhl-order.info/26782994631k9rt5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4455399/normal_5fd8efad56032.pdfIn PDF document text
    • http://ryursew.space/single_source_justification_letter_templateosbni.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4460982/normal_602ca9c8cc11b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4446645/normal_5fcbde71e07c0.pdfIn PDF document text
    • http://kozlo.space/bolingbroke_academy_sixth_formm53yi.pdfIn PDF document text
    • http://front-glass.website/76199429882czywc.pdfIn PDF document text
    • http://meetcabinets.xyz/what_is_the_coldest_temperature_in_jacksonville_floridanx4v9.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001228f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1228F 5436 bytes
SHA-256: d572a26824764a881cdea5687ca8d7fe12bce21a4bf1a4fdc581ef35960a6438