Malicious PDF — malware analysis report

Static analysis result for SHA-256 0c2c4bb4a76360d9…

MALICIOUS

PDF

78.2 KB Created: 2021-03-11 07:19:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 651b1364c6720adba220447f0192fc39 SHA-1: 291bbb1a6d087bfaa0bd0dd5fe020a255dd0d321 SHA-256: 0c2c4bb4a76360d9eaaf8417c4b9b32690b82784276d5a895cd27017d46e0299
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a specific detection name indicating it's a phishing trojan. An external URI pointing to 'dafemum.ru' was extracted, suggesting a redirection to a malicious site. The document body, though heavily obfuscated, contains text related to wallpapers, aligning with a lure for malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/123?utm_term=bajrangbali+ke+wallpaper+ing
    • https://gidigodojuk.weebly.com/uploads/1/3/0/8/130874472/bd4f1e8a7ef573c.pdf
    • http://kijekidajefi.getenjoyment.net/89061941403.pdf
    • http://muvirire.22web.org/25750183845.pdf
    • https://cdn-cms.f-static.net/uploads/4373997/normal_6044f4cb712b4.pdf
    • https://gimiduti.weebly.com/uploads/1/3/4/7/134711596/318bb369db6.pdf
    • https://pifixisoti.weebly.com/uploads/1/3/4/3/134379985/rogadoz.pdf
    • http://sakulog.sportsontheweb.net/kotikolov.pdf
    • https://cdn-cms.f-static.net/uploads/4382948/normal_602894c363845.pdf
    • https://pabaxovazat.weebly.com/uploads/1/3/4/3/134323574/8930309.pdf
    • https://cdn-cms.f-static.net/uploads/4446388/normal_6041b8fde8d98.pdf
    • https://cdn-cms.f-static.net/uploads/4367304/normal_60469cb9931b3.pdf
    • https://static.s123-cdn-static.com/uploads/4476765/normal_60003c3ee028d.pdf
    • https://vigodabazo.weebly.com/uploads/1/3/4/8/134872933/zusanatelukarib.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • https://uploads.strikinglycdn.com/files/395f84fa-582b-4447-b77d-a7234bb1263b/my_genes_made_me_do_it_download.pdf
    • http://xajizufobuvofo.epizy.com/netbeans_javafx_platform.pdf
    • https://uploads.strikinglycdn.com/files/bad89ac1-3285-4bcf-b99c-d2e818fb0458/how_to_practice_storyboarding.pdf
    • http://kolenexe.epizy.com/23047759297.pdf
    • http://zadaxuro.rf.gd/70023869601.pdf
    • https://uploads.strikinglycdn.com/files/907aff4f-c1c2-4e26-8257-56e1963978fd/nomuxipodep.pdf
    • https://uploads.strikinglycdn.com/files/fb15da4a-bf76-4db1-8620-a7d08d28a988/how_to_bind_traxxas_tq_receiver.pdf
    • https://uploads.strikinglycdn.com/files/f1330ae7-62ae-4762-8b08-c4091bda1181/lights_out_2013_cast_2016.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e3e6.bin
9c6218b6e387b4c23a734e09d570159298c2a61ff6108080dd9535593e7b7cd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE3E6 5228 bytes
font_01_sfnt_off0000f5dd.bin
471ee05bb88db7c8cba43937d023d25346d65a0a66ff3ef7b99e39429034bfc4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF5DD 10640 bytes
font_02_sfnt_off00011a10.bin
7664976e6a55e6e4545b7167b17742020be8e80099da347c564ae2b9144efafa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11A10 4556 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.