Malicious PDF — malware analysis report

Static analysis result for SHA-256 0e526d3499a7f65d…

MALICIOUS

PDF

79.9 KB Created: 2021-04-03 05:18:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0158e246a5d0cf0c17a1619e53550f03 SHA-1: d0edd1f0d544eb212db4e909ebc7fa5fe30422a0 SHA-256: 0e526d3499a7f65d30194cbdadf58a8c2e1188b806f3e6300977ca8f0ab21e78
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. An external URI pointing to 'xezojetit.ru' was found embedded within the PDF, suggesting a phishing lure. While no scripts were explicitly extracted, the PDF structure and embedded URI indicate an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=570+vs+580+vs+590
    • https://cdn-cms.f-static.net/uploads/4480745/normal_603be0a5b7a0f.pdf
    • http://fewafef.iblogger.org/dampak_urbanisasi.pdf
    • https://cdn-cms.f-static.net/uploads/4448332/normal_603ff466b0acb.pdf
    • https://static.s123-cdn-static.com/uploads/4428083/normal_6006aec74e05a.pdf
    • http://pafowitowa.medianewsonline.com/sabutunepuz.pdf
    • https://static.s123-cdn-static.com/uploads/4417220/normal_5fef5f1aa96e6.pdf
    • https://cdn-cms.f-static.net/uploads/4477183/normal_602f01757be41.pdf
    • http://mazikopipovix.mywebcommunity.org/avistar_denture_adhesive_reviews.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/wozoxub/11626731110.pdf
    • https://uploads.strikinglycdn.com/files/5da2fd82-3b4d-4f24-8380-b6c9819f89e5/xegujirog.pdf
    • https://s3.amazonaws.com/muvazi/66688292828.pdf
    • https://s3.amazonaws.com/vuzotisenixava/bootstrap_4_modal_input_form.pdf
    • https://s3.amazonaws.com/viregujipowuru/pulmonary_atresia_with_ventricular_septal_defect.pdf
    • https://s3.amazonaws.com/gavobawum/curriculum_vitae_consultant_template.pdf
    • https://s3.amazonaws.com/zakunafu/what_psi_is_karcher_k2.pdf
    • http://jumatomesanore.rf.gd/bidawonupejax.pdf
    • http://tatatomoti.rf.gd/rudram_telugu.pdf
    • https://uploads.strikinglycdn.com/files/2c2581ed-72b9-462e-8a5d-e520c30976d2/does_bruce_lee_have_a_child.pdf
    • https://s3.amazonaws.com/foneniz/counter_strike_1._6_z_bots_free.pdf
    • https://uploads.strikinglycdn.com/files/88bdf2a1-69ee-4e23-afd1-5deecab1019e/87538085533.pdf
    • http://bibesatu.epizy.com/petegopadevazugobusoxap.pdf
    • https://uploads.strikinglycdn.com/files/9380c9a2-af50-42b1-9d83-dbc23adc4c21/xazavoni.pdf
    • http://xutalapafulux.rf.gd/the_banking_concept_of_education_audio.pdf
    • https://s3.amazonaws.com/xuvamuba/78495981359.pdf
    • https://s3.amazonaws.com/fulosobezur/apache_kafka_free.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fa99.bin
6c6ec581e8acf334f120cb77ae5c41eb8870c569da81a109957d0bf75303ae26		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA99 5004 bytes
font_01_sfnt_off00010bc5.bin
fb1002be228bdc7e157119edc1babcba2ca87a4e2fc2a8fc82d001773b0ea70a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10BC5 11140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.