Malicious PDF — malware analysis report

Static analysis result for SHA-256 133cdd0a5cfe9c81…

MALICIOUS

PDF

76.9 KB Created: 2021-03-26 09:23:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5dd86e80cc44ea35e1896533e26e5254 SHA-1: 7ff4ecb021bc8b2c5514dc72494cbf6b925799ce SHA-256: 133cdd0a5cfe9c811a3f7287fc020770a75acf2fc8071b625ca42f0d3fa62107
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic indicating an external URI, specifically 'https://maypoin.ru/award?keyword=leave+application+for+employee+pdf'. This URL is presented within the document's content, suggesting a phishing or social engineering attempt to trick the user into visiting a potentially malicious site. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/award?keyword=leave+application+for+employee+pdf
    • https://cdn.sqhk.co/wijelukifap/V8Ahagd/world_chef_day_images.pdf
    • https://cdn-cms.f-static.net/uploads/4387819/normal_604fc493df04a.pdf
    • https://static.s123-cdn-static.com/uploads/4465131/normal_5fee4e35b2aa5.pdf
    • https://cdn.sqhk.co/murajefovel/gigjhUs/66684792545.pdf
    • http://mudubafap.iblogger.org/8810899031.pdf
    • https://cdn-cms.f-static.net/uploads/4407818/normal_5fe7ade5e5a3d.pdf
    • https://static.s123-cdn-static.com/uploads/4419832/normal_5fc86623b50e6.pdf
    • http://bawilidow.mypressonline.com/god_be_praised_chords.pdf
    • http://babilexogir.22web.org/cuisinart_k_cup_coffee_maker_says_descale.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://wanudoxemix.epizy.com/plantronics_backbeat_pro_2_manual.pdf
    • https://8a83ad47-1dc6-4e38-b726-138de0fe4a7e.filesusr.com/ugd/043c68_b6140cebd58a4cc7ac10e0bd10b2c645.pdf?index=true
    • https://3794eb9c-cc8b-492c-aecc-44533f76aaa6.filesusr.com/ugd/1ee69b_bd05e37576b14c83877a974240fb2e2d.pdf?index=true
    • https://5e54824a-8208-41b0-8aeb-7c017e8cfb46.filesusr.com/ugd/f64db8_8e65d7d909d44318acf25401dd519e8f.pdf?index=true
    • http://xonelamurojili.rf.gd/coast_guard_female_weight_standards.pdf
    • https://f7f2eb1f-4ce6-40bf-b337-6bcc2c9c1a95.filesusr.com/ugd/dc6899_5a3f3cdef5c64ac9a73456183c1d79b7.pdf?index=true
    • http://vipuzala.myartsonline.com/adverbs_exercises_upper_intermediate.pdf
    • http://jipiroto.rf.gd/bulats_practice_test_with_answers.pdf
    • https://a3e8d6b6-68ee-4625-a313-a25a09dbd39d.filesusr.com/ugd/312e12_f93256d8a1694d569b264b1b8df7fa87.pdf?index=true
    • https://275320ff-96dd-455a-9699-a0fdc58b27a5.filesusr.com/ugd/943725_bbdbf342992d4f53857dda8ce9895097.pdf?index=true
    • http://geforagegi.atwebpages.com/what_does_af_mean_on_cabrio_dryer.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e43a.bin
1f505ce05f7198ac9e858fadd015a938dd63293ef5fc51cd4c051cd4a2ea3842		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE43A 5016 bytes
font_01_sfnt_off0000f53a.bin
d0861032ac5293fa8feeeb9327464f9ab66140fc5138523e56f17dd836315f2c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF53A 10272 bytes
font_02_sfnt_off00011855.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11855 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.