Malicious PDF — malware analysis report

Static analysis result for SHA-256 0be11bb4d6bd3223…

MALICIOUS

PDF

87.9 KB Created: 2021-03-25 06:09:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8818a087bd943bdda6472e4c2d6a5c9a SHA-1: 0e2ffee05bf3a29b5b87075375f5bd8bd9c4f240 SHA-256: 0be11bb4d6bd32239eb685a2a2ec4baae454c7f5f317fcf95308101432df3c25
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that leads to a suspicious domain, likely intended to host a malicious payload or phishing page. The document body, though heavily obfuscated, suggests a lure related to search results or awards, aligning with phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=search+pdf+document+for+text
    • http://suwetobolubujub.getenjoyment.net/cctv_system.pdf
    • http://wojurimaxab.mywebcommunity.org/supidevofelepumiwox.pdf
    • http://nosixavol.sportsontheweb.net/transistor_s8050.pdf
    • https://cdn.sqhk.co/koroxofusino/CRhipA3/smart_assistant_realme_download.pdf
    • http://pikufufunuti.scienceontheweb.net/17230044139.pdf
    • http://rajukilodagoje.mygamesonline.org/samsung_refrigerator_ice_maker_not_dropping_ice.pdf
    • http://mibejar.sportsontheweb.net/code_de_l_urbanisme_sngal.pdf
    • https://vufobuvi.weebly.com/uploads/1/3/1/1/131163959/9705598.pdf
    • http://nibewubixela.getenjoyment.net/47304295145.pdf
    • https://cdn.sqhk.co/kejaxedusuk/1iakBjh/17108677748.pdf
    • http://fogafiv.mypressonline.com/hp_elitedesk_800_g1_dm_graphics_driver_pack.pdf
    • https://gufakapefevem.weebly.com/uploads/1/3/5/9/135994046/7388874.pdf
    • https://cdn.sqhk.co/rafopaluko/xiYhehe/storyart_insta_story_editor_for_instagram.pdf
    • https://lenololiwi.weebly.com/uploads/1/3/4/4/134455370/9918746.pdf
    • https://noregodexu.weebly.com/uploads/1/3/1/8/131871467/nuxegotevo-todumenebig-gasuparatanij.pdf
    • http://tosefabebiribow.scienceontheweb.net/51020565493.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://palalujopaxuv.epizy.com/elements_of_design_organic_shapes_pattern.pdf
    • http://pubitawiwinas.rf.gd/weather_app_free_for_android.pdf
    • http://gufopexolax.myartsonline.com/betug.pdf
    • http://jigobejebameg.epizy.com/40144136709.pdf
    • https://559ef5b4-38f4-491c-95f5-a6f57f0534fb.filesusr.com/ugd/1b862a_0958701528094696a63eb21ed48f7c85.pdf?index=true
    • https://b064d0e4-88d6-4b7e-8087-8ebf790fcba6.filesusr.com/ugd/ca32a8_7adecd3592fe4ec9b4370b4e5111a6e3.pdf?index=true
    • https://ed0f7819-48b4-4c0d-9119-93de03d81b9c.filesusr.com/ugd/e481ce_b89859d27b01472a88f7e1f6e9c8e431.pdf?index=true
    • http://wezebiwudure.epizy.com/project_issue_tracker_excel_template.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000105f3.bin
b966fd6d28a37e026f9d49a17587363e659f9d6853b589636428fb0e531bb44f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x105F3 5356 bytes
font_01_sfnt_off00011808.bin
0353b6d592cc8c9db41a4aa91071dcc800a137b27c86944595aa7a4f3c07e28c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11808 10692 bytes
font_02_sfnt_off00013cb3.bin
30fb556ae1ef0300fec1628121ed71449154f5dbb421b871db6f09551eaa31da		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13CB3 16120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.