Malicious PDF — malware analysis report

Static analysis result for SHA-256 0a814da64e17447e…

MALICIOUS

PDF

76.0 KB Created: 2021-03-23 22:57:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e25cf8a7e2f57c3d628b6c0e43c10908 SHA-1: bf92ca40f1cf55817a9c436bbf2855737b57255c SHA-256: 0a814da64e17447e1a4451d6e03e618d68722f5ef1e611769b18cea4ef347065
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a malicious domain. ClamAV detection and ML classification strongly indicate malicious intent, specifically phishing. The document body, though heavily obfuscated, appears to be a lure related to a search query, directing the user to the identified URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/wix?keyword=bruh+city+google+maps
    • https://cdn.sqhk.co/savageven/jbBjdgf/save_mother_earth_song_download.pdf
    • https://cdn.sqhk.co/sabumijobude/gjeFAfy/t_mobile_project_manager_salary.pdf
    • https://static.s123-cdn-static.com/uploads/4465402/normal_5ffcd96231f8a.pdf
    • http://fegokodelaxen.scienceontheweb.net/17972115097.pdf
    • https://cdn-cms.f-static.net/uploads/4387421/normal_6042fbb5635e1.pdf
    • http://dotixomovi.sportsontheweb.net/355_gears_vs_410.pdf
    • https://cdn.sqhk.co/gadukupuwe/IF2jfhd/mapigapupotikesox.pdf
    • https://cdn-cms.f-static.net/uploads/4460066/normal_60203b6dc7392.pdf
    • https://static.s123-cdn-static.com/uploads/4466661/normal_6006a342d19de.pdf
    • http://lorewipa.scienceontheweb.net/business_level_strategy_creating_and_sustaining_competitive_advantages.pdf
    • https://static.s123-cdn-static.com/uploads/4401989/normal_5ff4fd49b1187.pdf
    • https://cdn.sqhk.co/migefareg/0iahbhc/xutubejokixonoses.pdf
    • http://nunovoxiwanafuz.getenjoyment.net/background_color_jspdf.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/nosepevozux/anushka_shetty_news_andhra_guide.pdf
    • https://e7e1611e-f78d-4dfd-b5ce-3be5f579732f.filesusr.com/ugd/4b76a6_d6097a2937924e64bb8f8369ea7ee596.pdf?index=true
    • https://39472683-7d43-4bc3-882b-0947a83fd973.filesusr.com/ugd/544c7e_3e6cedf0a54f422198bd29f9b86f6bfb.pdf?index=true
    • https://s3.amazonaws.com/fadedosi/kiss_the_rain_easy_piano_sheet_free.pdf
    • https://41d9b059-0b17-466b-96e6-f31a3f3e9b19.filesusr.com/ugd/f1ead9_9f93380581244c57a9be67d3516b4f4c.pdf?index=true
    • https://s3.amazonaws.com/bevarolimesale/96139902226.pdf
    • https://15e12281-0fef-4bb1-b284-2b61ddec1698.filesusr.com/ugd/6c5390_cea20cde78e84565872ca0e46c2ff4eb.pdf?index=true
    • https://s3.amazonaws.com/gorajikunobixi/55972743184.pdf
    • https://393102e6-89af-4738-8cad-89662dba8dc5.filesusr.com/ugd/33a16d_315add07a62f49c39c89c77040f18d39.pdf?index=true
    • http://vizozaforuf.atwebpages.com/8601948977.pdf
    • https://s3.amazonaws.com/zerepuzuze/evacuating_london_narnia_piano_sheet_music.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec65.bin
44f5b7e647e91a99aca5ca12cfdcc20313e3fb885667edf372a2ed57dcc536ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC65 5500 bytes
font_01_sfnt_off0000fef9.bin
45df0d0192cb7f675f56f22edce09dc3faf6d9e219a6a5cabd082950426c92d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFEF9 10404 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.