Malicious PDF — malware analysis report

Static analysis result for SHA-256 0e6f542b4a3811db…

MALICIOUS

PDF

83.9 KB Created: 2021-03-29 01:06:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bf213e8e632cacead7ab1492fa181e3f SHA-1: b7c7b28eaa94a657c115f8c42e61dc54a46ca20a SHA-256: 0e6f542b4a3811db0a5d2baf881ad3d256547defeddcdc4715dd5ae7c963bb0f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that masquerades as a search result for a popular book title, likely to trick users into clicking it. ClamAV and ML classifiers strongly indicate maliciousness, and the PDF_URI heuristic confirms the presence of an external link. While no scripts were explicitly extracted, the nature of the embedded URL and the detection results suggest it may lead to a phishing or malware download site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9950

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=first+harry+potter+book+setting
    • http://bexowobiminefi.mywebcommunity.org/89300169784.pdf
    • http://dokukuke.mypressonline.com/tumokufure.pdf
    • http://fibisazorowax.mypressonline.com/how_much_do_pc_world_charge_for_repairs.pdf
    • http://barivelovone.22web.org/41076804787.pdf
    • https://cdn-cms.f-static.net/uploads/4365638/normal_602f392e32601.pdf
    • https://static.s123-cdn-static.com/uploads/4369643/normal_5fe26829f3740.pdf
    • https://cdn-cms.f-static.net/uploads/4458161/normal_6052c54bb49f6.pdf
    • https://cdn-cms.f-static.net/uploads/4450043/normal_6025c6cf2371f.pdf
    • http://sebafofugejal.22web.org/72603979882.pdf
    • https://static.s123-cdn-static.com/uploads/4419818/normal_5fe1a52621440.pdf
    • https://cdn-cms.f-static.net/uploads/4366042/normal_6047bd69ba690.pdf
    • http://tazikuruwuwozu.22web.org/zosile.pdf
    • https://cdn-cms.f-static.net/uploads/4411273/normal_6035c621d786b.pdf
    • http://vadosixajobirug.mygamesonline.org/cystitis_in_dogs.pdf
    • https://static.s123-cdn-static.com/uploads/4369516/normal_5fceccdec07b2.pdf
    • https://cdn-cms.f-static.net/uploads/4415045/normal_602c2dd12e187.pdf
    • http://zanakodus.22web.org/are_tanning_beds_really_that_bad_for_you.pdf
    • http://bumasujofoj.getenjoyment.net/26653228793.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/xowasosuf/ti_84_plus_silver_edition_pink.pdf
    • https://s3.amazonaws.com/mizeteb/modal_auxiliary_verbs_worksheets.pdf
    • https://s3.amazonaws.com/sowirutelevolur/solver_add_in_excel_2016.pdf
    • https://s3.amazonaws.com/megulu/56613930523.pdf
    • https://b1b1ed1d-a631-407f-b8a0-2f609481a9c2.filesusr.com/ugd/3e5895_0bce80819fcf4a92ad8551c4df9c860a.pdf?index=true
    • https://9f4ad419-87ad-4507-9b23-40b7c7395cc9.filesusr.com/ugd/55478e_dc9b063c04ac4ac7afa94c0f0af4d238.pdf?index=true
    • https://a29d81ee-e589-4368-99bd-4e0be04eb4c0.filesusr.com/ugd/a89e6e_fd84b8366b794dfa88e7c423daa610e6.pdf?index=true
    • https://0cfe495c-9a5f-46a1-a5f3-fb21b6211bac.filesusr.com/ugd/7aabb2_07d3a292932f4b519c8965d1005d4dd6.pdf?index=true
    • https://s3.amazonaws.com/vososasoxumete/how_to_apply_3m_decals.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f955.bin
6bfdcb0eea340d3afcddfd3bfca9b393c0936a52b0fd18da2b7067dc6df24f27		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF955 5096 bytes
font_01_sfnt_off00010aa4.bin
83a0fcb811b1908ccdca38b3ead4a58a34929fe7c3500c2e63106c632efe0763		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10AA4 11956 bytes
font_02_sfnt_off0001319c.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1319C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.