Malicious PDF — malware analysis report

Static analysis result for SHA-256 0b7cbf53c0c71a6b…

MALICIOUS

PDF

88.3 KB Created: 2021-04-06 03:23:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1849ac1c412fb6e915a79610f3a0dfc3 SHA-1: b614e25e3da2eb80d4905ee37994ca7c6342852c SHA-256: 0b7cbf53c0c71a6b67163619ece5e9793cbee2a5959c648c75d4b9850b2ec4b7
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to trick the user into visiting a malicious site for an 'award'. No scripts were extracted, but the overall structure and embedded URL suggest a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/award?keyword=extraccion+de+bromelina+pdf
    • https://cdn-cms.f-static.net/uploads/4368251/normal_60680aac7394a.pdf
    • https://cdn.sqhk.co/retirifurew/jbZRhih/vat_refund_calculator_france.pdf
    • http://ruxovesubilesuk.22web.org/savakivefutafokuranufi.pdf
    • http://gelixovuxa.22web.org/gate_2020_electrical_question_paper_with_solution.pdf
    • https://cdn.sqhk.co/kuzosexiwugu/Ogageu7/50749982083.pdf
    • http://trujillostacoshop.com/vupaxokerxrp4b.pdf
    • https://cdn.sqhk.co/nepajenine/ggKjchb/green_poop_meaning_newborn.pdf
    • https://cdn.sqhk.co/tinupolureg/ggcjb03/kanto_yu2_computer_speakers.pdf
    • https://cdn-cms.f-static.net/uploads/4424040/normal_5fdbd87c91ce2.pdf
    • https://cdn-cms.f-static.net/uploads/4408587/normal_604d33d41fe1a.pdf
    • https://cdn.sqhk.co/feduvefas/hbURjh3/17424363370.pdf
    • https://cdn.sqhk.co/wevamerazo/ghHuias/jump_rope_exercises_for_abs.pdf
    • https://cdn.sqhk.co/dugelabomaw/7jhzjgh/61927275008.pdf
    • https://cdn.sqhk.co/jodanonot/hbiciha/clinically_significant_drug_interactions.pdf
    • https://cdn.sqhk.co/fanalotozor/iggh5ae/pasiwupax.pdf
    • http://summerita.fun/minecraft_eyepod_modjp9r8.pdf
    • https://static.s123-cdn-static.com/uploads/4450641/normal_5fdf9a6983f82.pdf
    • http://dihtyar.online/prentice_hall_modern_world_history_textbookq1i6q.pdf
    • https://cdn-cms.f-static.net/uploads/4381098/normal_5fd2666aea986.pdf
    • http://bluebadgeform.com/surah_al_mulk_ayat_4wfh5b.pdf
    • http://sallles.ru/pazemixawopepipawur9lpfd.pdf
    • http://natorg.fun/65641550372qn5lh.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://dopusikarefo.rf.gd/piposogilazitex.pdf
    • http://batopodati.epizy.com/88225219533.pdf
    • http://gogewarixisude.epizy.com/jnc_8_hypertension_guideline_algorithm_2017.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010419.bin
2ed3a45aa1e8c735a30565147f5ac3c9da9e14db48c981ce6086fbeaf3b17406		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10419 6936 bytes
font_01_sfnt_off000115ba.bin
db0f80a899d9bdedcb02442f06772902f0860891f266f7ce5258fbdcf63f378b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x115BA 5288 bytes
font_02_sfnt_off000127a2.bin
6211662b925741e6674f24ac9d97c49e69eed8732c7009aabe42071bfe928726		 pdf-font-stream PDF embedded font (sfnt) at offset 0x127A2 12964 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.