Malicious PDF — malware analysis report

Static analysis result for SHA-256 148c8024322bbf88…

MALICIOUS

PDF

73.1 KB Created: 2021-03-31 20:24:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 187a7d8f3a900cd7f995554d6c208f28 SHA-1: e53537bfe790af3de4afd37ea96ae4b108d2b089 SHA-256: 148c8024322bbf88fa87a2afc7fd5ebfef8443d078bba49e8cd37de5af8ceb9e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, with heuristics indicating an external URI and embedded URL. The document body, though partially corrupted, suggests a lure related to a 'Lafarge portland cement safety data sheet'. The primary IOC is the external URI, which is likely part of a phishing campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/123?utm_term=lafarge+portland+cement+safety+data+sheet
    • https://static.s123-cdn-static.com/uploads/4450040/normal_5feffc16b6205.pdf
    • https://xujokutiw.weebly.com/uploads/1/3/4/7/134749543/vexikadakenute.pdf
    • https://fogofude.weebly.com/uploads/1/3/4/3/134322730/639c7096ddd99.pdf
    • https://static.s123-cdn-static.com/uploads/4469143/normal_600454ebe184a.pdf
    • https://cdn-cms.f-static.net/uploads/4417033/normal_5feaf2901a415.pdf
    • https://static.s123-cdn-static.com/uploads/4490539/normal_5fdd5a1196dc5.pdf
    • https://woxigixekamut.weebly.com/uploads/1/3/0/7/130739530/97b7ed5dc93.pdf
    • http://texitow.iblogger.org/michelin_guide_2020_london.pdf
    • https://cdn-cms.f-static.net/uploads/4418391/normal_60430b6eeab27.pdf
    • https://cdn-cms.f-static.net/uploads/4390385/normal_601dbb9a2b7c9.pdf
    • https://sevozinevuzejok.weebly.com/uploads/1/3/4/9/134903388/zesizi-wugikunonuxix-tojagedumorupop.pdf
    • https://static.s123-cdn-static.com/uploads/4407813/normal_5feff558bc809.pdf
    • http://bavewemelemare.iblogger.org/73676983074.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/62e725e6-37c0-48d5-a185-1ad1c391b9f6/40380873420.pdf
    • https://uploads.strikinglycdn.com/files/e314cdb7-96d9-4526-95c2-151d473117a8/fender_super-champ_x2_120v_guitar_amplifier.pdf
    • http://roranirit.epizy.com/le_code_des_collectivits_locales_tunisie.pdf
    • https://uploads.strikinglycdn.com/files/2b7cf927-dd01-4dca-b6d4-8345ae3f04f5/23556259188.pdf
    • http://darotevu.rf.gd/20195904681.pdf
    • http://xuxuxal.epizy.com/2259507979.pdf
    • https://uploads.strikinglycdn.com/files/e47dd568-7f95-436f-9859-cc0efadcc87b/how_much_annual_leave_do_you_get_a_month_nhs.pdf
    • http://podapuleleg.epizy.com/accidents_reported_today_york_pa.pdf
    • http://nizamazibenu.rf.gd/baby_carrot_nutrition_information.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000df7d.bin
649c4350b53d90610a1cd3df77f2a224c312ba92948a6598982c49f6f4f04ed4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDF7D 5612 bytes
font_01_sfnt_off0000f27a.bin
79bfe51c1f2bfc9ce09651ba206c7824be07e1adcbd6227fe0d4c6297bbd4203		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF27A 10140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.