Malicious PDF — malware analysis report

Static analysis result for SHA-256 14db0214bc83c1f3…

MALICIOUS

PDF

74.5 KB Created: 2021-04-04 18:38:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: f0b47324edee554579beae4fc9c36826 SHA-1: 3f5164e7da05c93777cf2891a9062b6833642c5a SHA-256: 14db0214bc83c1f306793b058964b33b04122886d60bb2278e427986c683dc17
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely intended to host a malicious payload or redirect the user to a phishing site. The document body, though heavily obfuscated, contains text related to 'House of night inspired tattoos' and the authoring application 'wkhtmltopdf', suggesting a social engineering lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/aws?utm_term=house+of+night+inspired+tattoos PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4412377/normal_601999bf71c7d.pdfIn PDF document text
    • https://cdn.sqhk.co/sobilowibid/jiDkPjd/38675497721.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4481164/normal_5fc67dc878ad0.pdfIn PDF document text
    • https://cdn.sqhk.co/basinasedu/hhgc1qE/scary_skins_for_roblox_free.pdfIn PDF document text
    • https://cdn.sqhk.co/wepiwuvume/j2hcifS/34125582532.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4490738/normal_604d2fb50c902.pdfIn PDF document text
    • https://cdn.sqhk.co/fenazijeguk/2jcQchf/92633380821.pdfIn PDF document text
    • https://cdn.sqhk.co/janogoxuke/a2OienN/bufoxutibojesitex.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4470408/normal_5fca9cc97b163.pdfIn PDF document text
    • https://cdn.sqhk.co/pixazizaze/cWG1pha/zisabevafozasuwiropiwo.pdfIn PDF document text
    • http://texivej.sportsontheweb.net/buvilefimelazulif.pdfIn PDF document text
    • http://pakirekugep.scienceontheweb.net/70551166598.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4383917/normal_5fe273d70dae8.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/pizivurapab/jobefegezajofij.pdfIn PDF document text
    • https://s3.amazonaws.com/gezizefefififa/alistair_glee_performance.pdfIn PDF document text
    • https://s3.amazonaws.com/boduxatavepe/awas_yojana_form_online_apply.pdfIn PDF document text
    • http://todiwefexoneb.atwebpages.com/wedipo.pdfIn PDF document text
    • https://s3.amazonaws.com/mijumomub/adhyatma_ramayana_in_bengali.pdfIn PDF document text
    • https://s3.amazonaws.com/lovomijelun/18918324513.pdfIn PDF document text
    • https://s3.amazonaws.com/telasebisu/76885178242.pdfIn PDF document text
    • https://s3.amazonaws.com/zuxime/boom_truck_inspection_form.pdfIn PDF document text
    • https://s3.amazonaws.com/lixuzo/64980560564.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e6b9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE6B9 5232 bytes
SHA-256: 10e425aff1e8b653f134b3c93e13c63d9256394e3a8dac25116f61a6836f5c9b
font_01_sfnt_off0000f880.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF880 10564 bytes
SHA-256: 11113f63dc39bd26e6692606e803e51e282582172e620fc80166e342006da227

Open this report in the interactive analyzer, or submit your own file for analysis.