Malicious PDF — malware analysis report

Static analysis result for SHA-256 0c644b715b5ea1b3…

MALICIOUS

PDF

79.5 KB Created: 2021-04-04 10:51:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: a6a6a1d5a1de7eb53a807a88bfe9876a SHA-1: e2bc8301b32f51c0cfbe02068194abafb9fc420c SHA-256: 0c644b715b5ea1b301e18c4b74d6efa626ddccb68e6ed978dcb124b578bdf2f0
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a suspicious domain. The ML classifier and ClamAV detection strongly indicate maliciousness. The document body, though heavily obfuscated, appears to be a lure related to 'anti lock braking system block diagram pdf' to entice users to visit the external URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/award?keyword=anti+lock+braking+system+block+diagram+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4480588/normal_60509a26b177e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4488842/normal_602616bbc945d.pdfIn PDF document text
    • https://cdn.sqhk.co/ferudati/hbhjCid/free_app_whatsapp_plus.pdfIn PDF document text
    • https://cdn.sqhk.co/rumobotituda/rhbhciV/formal_definition_of_apologia.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366009/normal_600b4ba32a507.pdfIn PDF document text
    • https://cdn.sqhk.co/gasawivu/gijc3gg/non_performing_assets_meaning_in_marathi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4444115/normal_601fd3703e8dd.pdfIn PDF document text
    • https://cdn.sqhk.co/runenuti/acdhq6O/the_night_manager_in_spanish.pdfIn PDF document text
    • https://cdn.sqhk.co/tasokuxu/0P4GXyg/dinosaur_world_movie_martin_short.pdfIn PDF document text
    • http://nafigunagofadab.getenjoyment.net/91651889252.pdfIn PDF document text
    • https://cdn.sqhk.co/nerenina/hi0hege/download_choice_of_the_ninja_mod_apk.pdfIn PDF document text
    • https://cdn.sqhk.co/tamireto/ChahdJn/pulse_point_scanner.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374951/normal_602d59efd7a47.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://pitigapevede.onlinewebshop.net/telecharger_attestation_employeur_pole_emploi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9d2d18dc-ba16-4917-8e2a-b31949ece72d/63808811220.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bc9d84bd-422a-4f36-9837-6344f8ed109e/can_german_citizens_work_in_usa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/36117070-5e27-4a62-a4ea-c842fba13445/1100_words_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/44cc9234-1dfc-469a-b7e0-f4fa1472e14a/line_6_pod_xt_live_patch.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4f0786c0-1e8e-478a-8e50-18e725cb44dd/mavomutudimizosoro.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3b21b0f1-7f02-4ae9-b104-4d549f1d73bd/how_to_use_cosrx_pimple_patch.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5e5fd550-6ae1-440a-bf13-124ef9a6d7a0/41837593947.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f8b7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF8B7 5768 bytes
SHA-256: fe0abe452a126ebf988a8c3f850fb409368f1f4601bd37c0ac3c4a0247b3fafa
font_01_sfnt_off00010c51.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10C51 10604 bytes
SHA-256: bac703874ace464f378e39a2a3f57dfa78eea78e4ccb07ef6e418bfa05be8929

Open this report in the interactive analyzer, or submit your own file for analysis.