Malicious PDF — malware analysis report

Static analysis result for SHA-256 0b573c94e8d286d1…

MALICIOUS

PDF

91.7 KB Created: 2021-03-12 02:28:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-20
MD5: 06f421ec195cfabfcb69fe7a5e6589b6 SHA-1: d02233cd84f4322692cc5a0bf465d3b4b4098ca7 SHA-256: 0b573c94e8d286d1f7a2c8ad8df526c992b93368d168c9cf8945c76d8828491c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating it is malicious and a phishing attempt. It embeds external URIs, specifically pointing to a URL that appears to be a lure for users seeking help with a Kindle Fire. The ML classifier and ClamAV detection strongly suggest malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/aws?utm_term=how+to+force+quit+kindle+fire PDF link annotation
    • http://setofexperience.site/screen_mirroring_apk_for_tvkiejj.pdfIn PDF document text
    • http://uscarins.info/16630945442109c9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451028/normal_600ffda346195.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378155/normal_5fd36bfddfda7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454671/normal_601b7c24bf315.pdfIn PDF document text
    • http://madamzero.com/xesaxumodezuahvjk.pdfIn PDF document text
    • http://hugertely.xyz/warojisojevilemepab25h9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367903/normal_60367a37413db.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418557/normal_604aabf7bf458.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://84bd2c60-91d0-47b6-9565-6ae8a6593e58.filesusr.com/ugd/963627_06e615faf2e34494a6a8f72525313c96.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vatosolikijike/43883030923.pdfIn PDF document text
    • https://ca3ec1ac-6ff7-4c8f-ae0f-86a30d86e335.filesusr.com/ugd/3615fb_94335ee55e814dd6bf2034aec2c124a6.pdf?index=trueIn PDF document text
    • https://9b704b87-3668-414c-a24e-b30400fe0e33.filesusr.com/ugd/51c472_53178fb170064db793e22e33c5580665.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/f9ec106c-9507-4c34-86a3-a02ef27bc432/pabijobavudupolo.pdfIn PDF document text
    • https://s3.amazonaws.com/sorogamat/kamejulabigokoxofutaw.pdfIn PDF document text
    • https://s3.amazonaws.com/rojalexipokadaz/different_types_of_spur_gears.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/30be654d-95c3-4d3b-a65c-aada5aa8cbaa/21745636968.pdfIn PDF document text
    • https://9fbeb193-358d-48fe-b9d9-45f8b63f6b3c.filesusr.com/ugd/ab67b9_cd8b962b20a840c49f3dee4b1ffa2618.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/5ac889c1-9304-46d5-aa99-d74b267cfda5/pexejepo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b8407ced-7017-454b-89c0-be862d5c255e/lubasodogukedomupavafibo.pdfIn PDF document text
    • https://s3.amazonaws.com/begijufadi/information_technology_meaning_by_oxford_dictionary.pdfIn PDF document text
    • https://1bf92926-22d0-44a1-94fb-b51843c41cd5.filesusr.com/ugd/762c1a_3182b2bbd22b43359076a98adf6bd758.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fidefofudi/how_did_maya_angelou_achieve_her_greatest_goal.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011543.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11543 4872 bytes
SHA-256: 4e7a8dc15f6ecced71fff79de94b25a4b04a448b8d51692259b0362126091506
font_01_sfnt_off000125f6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x125F6 11136 bytes
SHA-256: 2b17eb4a74718b93a306cfa44616b3429e7158cb4c9d3fbc0d2e13fa410bccc8
font_02_sfnt_off00014c24.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14C24 16164 bytes
SHA-256: 2fbac63b5a756b8d2f06f7489080bd85868295e8a8ab77409c4265f29de0f03c

Open this report in the interactive analyzer, or submit your own file for analysis.