Malicious PDF — malware analysis report

Static analysis result for SHA-256 10acfe80846239d1…

MALICIOUS

PDF

71.3 KB Created: 2021-03-11 08:58:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d0751d1a18848366d5deaf7c5511e9f3 SHA-1: e0016cd895d06b70aa6f79c2d51fbc18f4f29e35 SHA-256: 10acfe80846239d1e1c65ac91764fa9b65832057f0539565f937757b07638f2c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ML classifiers and ClamAV. It contains an embedded URI pointing to 'vilenefex.ru', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to a 'Golf buddy aim w10 user manual'. No scripts were extracted, but the presence of external URIs and the overall detection suggest an attempt to trick the user into visiting a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=golf+buddy+aim+w10+user+manual
    • http://help-copyrighteamservice.com/702492227375l3vg.pdf
    • http://batut.space/zabukodimunuveh6fpf.pdf
    • http://christmas-gift.ru/nonewcerx1.pdf
    • http://fanilepitas.22web.org/73674653946.pdf
    • http://trynon.xyz/why_do_raindrops_falling_under_gravityre9ew.pdf
    • http://mosovonetuvu.iblogger.org/netox.pdf
    • http://cesaregaspari.com/is_a_guardian_ad_litem_an_attorneysc9ps.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://9049409e-dcbb-43fe-b7cb-0f7a5d042cf1.filesusr.com/ugd/e59eee_e41b3995f7944e2c9a70e047322c5596.pdf?index=true
    • https://s3.amazonaws.com/dixaleko/how_big_is_a_6_quart_pressure_cooker.pdf
    • https://f815f12b-539f-4060-8ed9-abd2caada31b.filesusr.com/ugd/ceb2e8_89daf879a7064ec18346f2002795e566.pdf?index=true
    • https://uploads.strikinglycdn.com/files/264356d0-2e41-409e-8201-7ff582d355b6/soccer_classes_for_10_year_olds_near_me.pdf
    • https://uploads.strikinglycdn.com/files/0fd318ca-1b02-47b3-b55c-18c2dd85abf8/asus_rt-ac68u_aimesh_ac1900_prisjakt.pdf
    • https://0e67983c-e844-40c9-b604-97311ec94efe.filesusr.com/ugd/6e13d9_65a5f6dc5cc34cbcb76af297be94e7c3.pdf?index=true
    • https://uploads.strikinglycdn.com/files/f8259cfd-08dd-475b-9446-b10bb12db8a5/8560730318.pdf
    • https://s3.amazonaws.com/remavuj/affliction_warlock_arena_guide.pdf
    • https://s3.amazonaws.com/gorajikunobixi/jiperebinizifula.pdf
    • https://s3.amazonaws.com/rovuweraja/chess_notation_sheet_printable.pdf
    • https://uploads.strikinglycdn.com/files/2c5fffa9-280d-42c9-b831-98bf029b08ca/what_are_the_different_restrictions_on_drivers_license.pdf
    • https://s3.amazonaws.com/xisefowu/english_grammar_lesson_plan_for_class_6.pdf
    • https://uploads.strikinglycdn.com/files/42cb4553-0bbd-42ec-b25e-f355d4d42543/zigutipebodenanim.pdf
    • http://menawikilu.rf.gd/551514216.pdf
    • https://uploads.strikinglycdn.com/files/9d19aa8c-2ced-4f96-9a1e-033b4278fcb3/wipiximurito.pdf
    • https://0296ecfc-28ae-4fa5-925c-67a25994cace.filesusr.com/ugd/c88839_a71123d09eb6490ebf522617d0c98fc3.pdf?index=true
    • http://kuminatunajovop.epizy.com/41105373721.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d9b2.bin
013254ffcd3c2a4706e2c3238e1d1e3a70fe4447c6b6e1a5b4add5d3bdefdeca		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD9B2 5612 bytes
font_01_sfnt_off0000ecd0.bin
5ac819a85125ec0b2b5ee678aba508b2e975e1ab1fd1d17e19d5bcb01cfdbdb4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECD0 10128 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.