Malicious PDF — malware analysis report

Static analysis result for SHA-256 0acea609a68cfa82…

MALICIOUS

PDF

76.7 KB Created: 2021-05-19 08:20:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: e05ac653ba9f1abf114f6881f29ce5fa SHA-1: 8a6f3b0b39c483742a47a8caab7ad4a608a30958 SHA-256: 0acea609a68cfa82bb4c661fb6572f7a35805b64afd798485980984650e32c24
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, 'vilenefex.ru', which is likely used to host a phishing page or deliver a secondary payload. The document body, though heavily obfuscated, suggests a lure related to 'mtnl landline surrender letter format in marathi', indicating a targeted social engineering attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9960

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=mtnl+landline+surrender+letter+format+in+marathi PDF link annotation
    • http://sebokuxaxugu.iblogger.org/75035313947.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/002fac56-8661-4651-9899-c40372118da7/generac_gp3300_muffler.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6659c9d3-045e-482b-b215-0fe04fccdc48/what_are_the_poetic_devices_in_the_road_not_taken.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1f4f52d3-bb34-461c-8577-4d8b8ff1159a/35454405310.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4152330b-fd2c-41b8-b250-28f0c19fa43b/95675413607.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1be8780f-781e-477e-83f8-909184997a8d/focusrite_scarlett_2i2_3rd_gen_usb_audio_interface_with_pro_tools_first.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/18ca6bd3-862a-4d27-ac40-69b43b7155aa/how_do_i_reset_my_pdp_controller.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3187d33c-a5c0-42fa-b616-f4287ec317c7/sabesuluzikikezanar.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/78c4d836-4f65-4942-9be3-3bd3232a775b/97814753329.pdfIn PDF document text
    • http://joruvone.epizy.com/apostila_auditor_fiscal_municipal_gratis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/573a153d-f935-4a6a-b604-3e01e779ff1d/defiant_solar_motion_security_light_2100_lumens.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e3b50681-8c86-4c05-85f9-e044eba35eaf/panebedafirajuvodovofime.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7c6eb3fe-acc3-4aee-8c2d-7d17361d2a9b/what_is_the_meaning_of_advent_candle_colors.pdfIn PDF document text
    • https://s3.amazonaws.com/jepavilutabilel/rmit_citation_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a84b88b0-faf6-4f60-8d99-5cdc7c78d338/data_structures_and_algorithms_in_java_6th_edition_source_code.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9a7f8226-d9cd-447a-8b1f-fe1a98033146/que_formas_de_expresion_oral_existen_wikipedia.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/487cbe3c-007a-4825-ad46-aa2191f3fa6f/setup_my_harmony_350_remote.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/30c40206-e463-4007-8b35-a2301089f03f/what_does_the_word_alpha_male_mean.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7d52e692-b1de-4d85-802d-2e9baff32470/python_iterate_through_string_in_chunks.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6f97dfe3-5a27-4369-bfcb-7315b074d0df/3737204496.pdfIn PDF document text
    • https://s3.amazonaws.com/tixeligufokup/clair_de_lune_sheet_music_easy.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/df2bd1cb-354a-4d41-9c14-e9f6c6192d20/chicken_soup_for_the_soul_stories_of_hope.pdfIn PDF document text
    • http://sovotovagito.epizy.com/maths_formulas_upto_class_12.pdfIn PDF document text
    • https://s3.amazonaws.com/loxopudizus/salesman_comedian_2018.pdfIn PDF document text
    • http://tatepazutapoz.rf.gd/91449679478.pdfIn PDF document text
    • http://pewulalabes.epizy.com/the_rules_of_basketball.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef7c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF7C 5152 bytes
SHA-256: 7779f32eb5b2f7e45e32c31320f6de9cb4c4367073be8964b10564d56763c965
font_01_sfnt_off000100e0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x100E0 10604 bytes
SHA-256: eb864b7baf933fed2ed7f81fd78cc0f8431f1b29dc98ec7d0c5110faed98205d