Malicious PDF — malware analysis report

Static analysis result for SHA-256 09030ffa6fddd78e…

MALICIOUS

PDF

116.0 KB Created: 2021-03-14 11:47:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d5df255c04f1de01dae86c46cd9f210f SHA-1: 78bf97fade31b64d3c4397b31f6ee0efd66fb89b SHA-256: 09030ffa6fddd78ef9d1178ee4413602231a5952790ed32370feb8cf47bcc7e2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains an external URI pointing to a suspicious domain, likely intended to host or redirect to malicious content. The document body, though heavily obfuscated, suggests a lure related to 'Sjcam sj4000 application'. No scripts were extracted, but the PDF structure and external URI suggest a phishing attempt to redirect users to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/strik?utm_term=sjcam+sj4000+application
    • https://cdn.sqhk.co/digubamot/TiaijHq/8610111965.pdf
    • http://fikosarodone.medianewsonline.com/multivariate_statistics_researcher.pdf
    • http://bawazofo.getenjoyment.net/tokyo_ghoul_re_manga_anime_differences.pdf
    • http://galoomer.online/lufufisujodamomugoduwabuzlt0.pdf
    • http://mishgen.com/91633283743vatuk.pdf
    • https://cdn.sqhk.co/dazulegug/iiHCjjr/draw_road_3d_level_11.pdf
    • https://cdn.sqhk.co/toxodabatot/hijcaA4/maxevubelesi.pdf
    • https://cdn.sqhk.co/tanusulirava/g1whcvQ/3838914459.pdf
    • https://cdn.sqhk.co/lanuniwa/ggTijid/water_parks_in_houston_tx.pdf
    • http://poxumanavofeboz.scienceontheweb.net/30426798155.pdf
    • https://cdn.sqhk.co/zejegure/HGEhhid/29667066925.pdf
    • https://cdn.sqhk.co/zujubiviv/nlTiehj/electrical_interlocking_wiring_diagram.pdf
    • https://cdn.sqhk.co/wapogade/GFiehcC/maths_tricks_with_answers.pdf
    • https://cdn.sqhk.co/nezipumosot/lvRifhc/starbucks_secret_menu_2020_recipes.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/f6fe20da-6950-47b7-95dc-67e946bed95e/niwejovigizizu.pdf
    • http://fubavinexazixo.onlinewebshop.net/17047351811.pdf
    • https://uploads.strikinglycdn.com/files/7883b50d-6f6f-452c-b833-89e2d968ec64/my_cloud_home_setup_static_ip.pdf
    • http://binasizula.rf.gd/51538887314.pdf
    • https://uploads.strikinglycdn.com/files/99ac7809-4028-41cc-86d8-85016a34d9d2/how_to_use_onn_earbuds.pdf
    • http://duvaneloxa.epizy.com/google_agenda_gratuit_android.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f17c.bin
b14f4c23898d76de39757378aabd16324c945bbdfe4e86ca9203df75154c9be2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF17C 36948 bytes
font_01_sfnt_off00016278.bin
7118e092414807bbbb080576515ac5152ff5c02e1e3d4f06beec184cfc4655fa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16278 5064 bytes
font_02_sfnt_off0001738e.bin
72c581974bb68c0f4f8a5c85fcf4d109b27dda66555557a5a8a6b6fedd846c5c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1738E 13140 bytes
font_03_sfnt_off00019e7a.bin
31aa257675234f953cb39254c73a0c002637764ec2691c470e0912636c3685cf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19E7A 16204 bytes
font_04_sfnt_off0001b3a8.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1B3A8 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.