Malicious PDF — malware analysis report

Static analysis result for SHA-256 0ee32f9176e056c7…

MALICIOUS

PDF

85.4 KB Created: 2021-05-08 09:11:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 21c5f4eba5ec919078a9778e52b6a0c4 SHA-1: d51d4c1b57925635e864bf0c761fe67358b7456a SHA-256: 0ee32f9176e056c719c1e89c2c0819446a0b3ed43b1c97e526dc8aae08d36354
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, identified by heuristics as a potential external URI and flagged by a machine learning classifier. ClamAV also detected this file as a phishing trojan. The presence of these indicators suggests the document is designed to redirect users to malicious content, likely for phishing or to download further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=is+vegetable+oil+ionic
    • https://kuweperiti.weebly.com/uploads/1/3/4/9/134904821/keropibezoji_ximelojasaga_mulofilimu.pdf
    • https://cdn-cms.f-static.net/uploads/4421776/normal_60276ffa2ace9.pdf
    • http://sale20.site/best_app_for_couples_hotel_bookingd2jqv.pdf
    • https://biwaxosele.weebly.com/uploads/1/3/1/4/131437294/703066b9c7.pdf
    • https://cdn-cms.f-static.net/uploads/4454051/normal_6057f1ceccc3a.pdf
    • http://businesslinecenter.com/99356899528anjc9.pdf
    • https://vujirazezada.weebly.com/uploads/1/3/2/6/132681664/9450537.pdf
    • https://cdn-cms.f-static.net/uploads/4454679/normal_604e868538568.pdf
    • http://begemotiks.space/airline_booking_system_gabriel_user_s_manual86s12.pdf
    • https://kukixagunobi.weebly.com/uploads/1/3/5/3/135325453/zuvejilusul_motusakuna_xafub.pdf
    • https://giravegide.weebly.com/uploads/1/3/2/6/132681237/faximoragokul_lefuke_dapavola_najoboxan.pdf
    • https://cdn-cms.f-static.net/uploads/4407304/normal_606ae847797c3.pdf
    • http://merovew.xyz/55871759730hb6wv.pdf
    • http://icub.tech/977964798ko3ok.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://loserelosov.rf.gd/the_bible_in_living_english_download.pdf
    • https://s3.amazonaws.com/fevobelijogal/mr._alexander_physics_vector_addition_worksheet.pdf
    • https://uploads.strikinglycdn.com/files/35d7c5df-2b04-423c-8df2-7700239509a1/the_andromeda_strain_streaming.pdf
    • https://s3.amazonaws.com/ragejufa/going_to_worksheet.pdf
    • https://s3.amazonaws.com/devuxuzejozam/concepto_clases_y_caractersticas_de_los_ttulos_y_operaciones_de_crdito.pdf
    • https://uploads.strikinglycdn.com/files/46923208-c312-447a-87af-f0c9d2e383df/2013_subaru_impreza_hatchback_headlight_bulb_size.pdf
    • https://s3.amazonaws.com/dovulavavo/is_final_fantasy_7_remake_part_2_going_to_be_on_ps4.pdf
    • http://texatopewewew.epizy.com/19185759660.pdf
    • http://bosulug.epizy.com/95377795646.pdf
    • https://s3.amazonaws.com/viregujipowuru/rightly_guided_caliphs_definition.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010f9e.bin
b1ec747fe9f52219f46e80d1c99472c68fb557335d0f3b9d41b2700f91f3741c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10F9E 5008 bytes
font_01_sfnt_off000120c6.bin
ab8401e4dfe139eee9bcd877ff6e77861d3a116456d240e2b414d070b926f864		 pdf-font-stream PDF embedded font (sfnt) at offset 0x120C6 11244 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.