Malicious PDF — malware analysis report

Static analysis result for SHA-256 0eb17b43151eb590…

MALICIOUS

PDF

77.7 KB Created: 2021-04-20 01:44:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-16
MD5: 1a42432bd8df0077d30d7b95afd8e3a0 SHA-1: 4755b66991f3ac0f8386ff2e825ebc6b03fc05d8 SHA-256: 0eb17b43151eb5909994e63fcd806800e213c4708b35d6c0bf2fd8c4c77d13bb
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also flagged the PDF as malicious. The document body, though heavily obfuscated, appears to be a lure related to grammar, suggesting a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=when+to+use+oxford+comma+ap+style PDF link annotation
    • https://cdn.sqhk.co/gulifunanale/BPq8ogc/bufiti.pdfIn PDF document text
    • https://cdn.sqhk.co/numisezopo/bjeXojc/half_number_worksheet.pdfIn PDF document text
    • http://pubgmobiie.com/ximokomexeloxobpq7sj.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421199/normal_606af335eee0c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454054/normal_5fec50b030813.pdfIn PDF document text
    • http://beststudent.space/zoology_projects_for_class_12oodtt.pdfIn PDF document text
    • http://bobr.space/legend_of_the_five_rings_dice_rollerto4hx.pdfIn PDF document text
    • http://excschool.ru/accu_chek_multiclix_lancet_how_to_useixm3w.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4412158/normal_5ff5843f013e9.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/tinezedu/bharat_full_songs_ming.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5b21c1a8-f2d8-48e2-94fb-420c74aba0b9/waterway_22_sand_filter_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/sevoga/why_is_my_dryer_not_drying_my_clothes_well.pdfIn PDF document text
    • http://zusilovame.epizy.com/87061084613.pdfIn PDF document text
    • https://s3.amazonaws.com/wenobagupexekap/53377424032.pdfIn PDF document text
    • https://s3.amazonaws.com/xonaxevetaf/xufarajivepixanedezidem.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c4b044dd-2696-4a25-a4d1-f74b794f01dc/christopher_hitchens_god_is_not_great.pdfIn PDF document text
    • http://wanudag.rf.gd/logadalonodumijuriguj.pdfIn PDF document text
    • http://giwuvupajot.epizy.com/69190750636.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e85a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE85A 5580 bytes
SHA-256: 64f65eff7e8f2adf6d1d1f94aa9b36c7063620026771f3edbbb72c013ce9dd2d
font_01_sfnt_off0000fb38.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB38 2012 bytes
SHA-256: 1182553af4e4e1d4f08dc5c53a41ba3cf7bb24133579164eb638a84c8e765df2
font_02_sfnt_off0001046b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1046B 10876 bytes
SHA-256: 994431f9d2549dd6911f60985fd90926a26b1aab267fb7dab60d7fb5b3df2e21

Open this report in the interactive analyzer, or submit your own file for analysis.