Malicious PDF — malware analysis report

Static analysis result for SHA-256 0ce7778bee2999a5…

MALICIOUS

PDF

92.7 KB Created: 2021-05-12 22:47:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3b2e0a1ad17f08625d0e3d82f181d6d4 SHA-1: af9ffdc0b529c0bdb0db66936a2ab51b146ccd4c SHA-256: 0ce7778bee2999a57b2661fc8dad405bb87d0045ed6cc0bc1e192353d3a88f8a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as a malicious PDF by multiple heuristics and a machine learning classifier. It contains an embedded URI pointing to a suspicious domain, which is likely used to redirect the user to a phishing or malware distribution site. The document body, though heavily obfuscated, contains text that appears to be a lure related to military personnel, suggesting a targeted phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=milpersman+1070+series
    • http://zumufufup.sportsontheweb.net/84787849309.pdf
    • http://saxoxiwu.iblogger.org/intel_dq965gf_motherboard_processor_support.pdf
    • http://kogejirupu.getenjoyment.net/electrician_apprentice_resume.pdf
    • http://tumbaa.space/composition_of_functions_worksheet_answers_kuta_softwarexd3ia.pdf
    • http://boxupoxegetoji.22web.org/maisie_dobbs_a_dangerous_place_synopsis.pdf
    • http://tekelijod.iblogger.org/toniolo_cemento_armato.pdf
    • http://bitcoinlearningcentre.online/56391829731y63q2.pdf
    • http://mamefumiwuto.mywebcommunity.org/xutiguzinejifutopuwide.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/sojenozap/hillcrest_christian_college_berwick_uniform.pdf
    • http://xepepofebaxuvib.epizy.com/muvinawutunupusola.pdf
    • https://5c9c3928-af7d-4195-9e43-9647d7263c15.filesusr.com/ugd/508998_a935f77a1f644a399f514d2f88f34fdb.pdf?index=true
    • http://jibomivuren.epizy.com/gearbox_casing_design.pdf
    • http://ravuxigud.epizy.com/introducing_yourself_worksheets_english.pdf
    • http://nevafofuvabovid.atwebpages.com/63139191001.pdf
    • https://6a1e2a5f-c456-4288-b9d5-5378f87870fb.filesusr.com/ugd/076fac_f8ff9c42b1df4d1b8d0ffe82cdc8f322.pdf?index=true
    • https://s3.amazonaws.com/banula/6861300740.pdf
    • https://8b62b971-d575-4461-ae89-9de7a2afac08.filesusr.com/ugd/c5a911_0d43a92d5e69445b8a05ff57c560a011.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013119.bin
844bae7fa72e888f727a6bad5df5a80580bb9615368de9669c4b7e2b434de3d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13119 5244 bytes
font_01_sfnt_off000142e6.bin
e9ca8ece6a0937c0a08c1764171b6c383fa058d26cd3fab26aa0956ace2cedcd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x142E6 10276 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.