Malicious PDF — malware analysis report

Static analysis result for SHA-256 083e66633ebc3400…

MALICIOUS

PDF

77.2 KB Created: 2021-02-10 22:17:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12
MD5: 3571e7bb348d14a4a7ea2a1583583dea SHA-1: f342e1e805fe9167522316d7c6b20d1ddd0ddb32 SHA-256: 083e66633ebc340056f16044703cbcd53ae936356557ba35863a59a116bcb01e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to 'https://maypoin.ru/aws?utm_term=caller+name+id+android+app', which is presented as a lure for an Android caller ID application. The document body is heavily obfuscated, but the presence of the malicious URL and the ClamAV detection name 'Pdf.Phishing.Trojan' strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/aws?utm_term=caller+name+id+android+app PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4490251/normal_600be799b9784.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4494432/normal_5ff5bfaf4af8d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4420018/normal_5ff8dc3c44f28.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4402948/normal_5febff8c22298.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4445750/normal_5fe004fa45d66.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4501660/normal_5fe40af3f3cbf.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4385437/normal_5fcb71680c3e3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4495399/normal_5fd2278369f74.pdfIn PDF document text
    • http://autokenn.com/7261679104nh2q7.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4461751/normal_5fe2c6c9492b0.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://rujipezoj.epizy.com/munag.pdfIn PDF document text
    • http://zupifokurox.rf.gd/mibumizusasuzitubagi.pdfIn PDF document text
    • http://xozelabudizi.epizy.com/aneurysm_saccular_vs_fusiform.pdfIn PDF document text
    • https://s3.amazonaws.com/tojabixefova/google_sheets_query_function_join.pdfIn PDF document text
    • https://s3.amazonaws.com/rizezobabub/dr_blends_worksheets_for_kindergarten.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e6ba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE6BA 4832 bytes
SHA-256: 0899a669078d213f09d9b15306ecb43f3fc0777b36bb9f2bd58d343e0cede540
font_01_sfnt_off0000f700.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF700 4284 bytes
SHA-256: 681444574658f47e8a088e51be8472bb5147d323249e3d9acb2d57ea34902ffd
font_02_sfnt_off00010287.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10287 10864 bytes
SHA-256: 46b435cf6f3b423b3fb89ff980288c6c81cbb5a8da3d1c5d11f304a87b0a489a

Open this report in the interactive analyzer, or submit your own file for analysis.