Malicious PDF — malware analysis report

Static analysis result for SHA-256 0aff93bdf775f1a8…

MALICIOUS

PDF

95.5 KB Created: 2021-03-18 23:41:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 4c21ed7f6db05f9b1365d6f6a2f02a12 SHA-1: d076da29b08c3e5f528f22e948136fffc2d04dd8 SHA-256: 0aff93bdf775f1a869e24ee32ac7073e4fb5c2cfa2464c4f52d82d5b8643da60
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The file is a PDF document that uses a lure related to flight refunds to entice users. It contains an embedded URL that points to a suspicious domain, likely for phishing or malware delivery. The ML classifier and ClamAV detection strongly indicate malicious intent, and the heuristic for payment redirection lures further supports this.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/strik?utm_term=how+to+get+a+flight+refund+from+ryanair PDF link annotation
    • https://cdn.sqhk.co/vovewotutal/jgzjhge/nerf_gun_zombie_strike_crossfire_bow_blaster.pdfIn PDF document text
    • https://cdn.sqhk.co/pixazizaze/ihjOxid/69281523831.pdfIn PDF document text
    • https://cdn.sqhk.co/terodekijur/cdJZi6X/h._i._d._e_game_apk.pdfIn PDF document text
    • https://cdn.sqhk.co/fabunavaxa/jegia0O/real_boxing_2_apk_obb_mod.pdfIn PDF document text
    • https://cdn.sqhk.co/poronujefino/jfLaT1c/modukowelifasulabex.pdfIn PDF document text
    • https://cdn.sqhk.co/gebitasixa/icjfNCj/basketball_shot_tracker_sheet.pdfIn PDF document text
    • https://cdn.sqhk.co/kabevapixox/TlKc1HW/zaderirunexuge.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485704/normal_600cc920899d8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450042/normal_604adc06d15f8.pdfIn PDF document text
    • https://cdn.sqhk.co/dusivubeleza/gicrUgf/sky_whale_game_free_online.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/4a314b7b-b3c1-4f15-b1c3-42b03eb2237c/linksys_wrt160nl_repeater_mode.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/996098d0-ce9d-4c44-9bfe-ec5da499a414/11128992331.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d0fc25ee-bd0c-4b6c-92ef-1881e20f280d/magujusezisofi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3d9f5eb8-dfca-428d-a45c-819b62c36fe7/zigog.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f75d9745-92ee-4f51-b01d-4724c9620f89/77888703596.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/43145353-3dd0-402b-80de-3b0e442d6a94/42562869374.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/881d8c2c-906c-4d78-80a3-12bdc8a4f3eb/jagizomofarejakagirim.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0aee402a-6991-4401-becc-f96e56f487f6/rope_knots_for_dog_toys.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a4cefba9-e25e-441e-a1fb-553a5dd3ac0b/dijumezexupukexeke.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f0633ae3-d74f-4983-bc26-62cf4161483a/classic_ford_mustang_for_sale_las_vegas.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000137f6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x137F6 5300 bytes
SHA-256: b68aa5f011c11cc05b9fb77605d4ac8b5c8bc59c87a934f4ee24678ed0d33fa5
font_01_sfnt_off000149eb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x149EB 11424 bytes
SHA-256: f93509219ebb14d396e4550a2bd355490a0b132d9685dc89ae842f27dee9f6f2

Open this report in the interactive analyzer, or submit your own file for analysis.