Malicious PDF — malware analysis report

Static analysis result for SHA-256 15b3fe0108850e65…

MALICIOUS

PDF

95.4 KB Created: 2021-03-16 03:29:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 38dfa886608d233717a3fb9d2eb74239 SHA-1: 171942c9c0ac4a63b55c6d14165df14240c67d9b SHA-256: 15b3fe0108850e659b81e835cdfee32a9ef00ca711f3f0a11dd0c049a8d0c106
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to a suspicious URL, likely used as a lure for users to download the PDF. The PDF structure itself also shows signs of manipulation, with duplicate object bodies, indicating a potential attempt to evade detection or embed malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/wix?keyword=you+are+a+badass+everyday+pdf+free+download
    • http://xubajur.mygamesonline.org/how_to_connect_my_fitbit_versa_lite_to_my_phone.pdf
    • http://xiwakaravivomik.scienceontheweb.net/57524433390.pdf
    • https://static.s123-cdn-static.com/uploads/4366947/normal_5feb1630145a4.pdf
    • http://sabumow.mygamesonline.org/xumukebam.pdf
    • https://cdn-cms.f-static.net/uploads/4479707/normal_6022d754a3b02.pdf
    • https://cdn-cms.f-static.net/uploads/4479439/normal_601695c05dc61.pdf
    • http://gatowixipeba.mywebcommunity.org/blackmagic_design_intensity_pro_4k_manual.pdf
    • https://cdn-cms.f-static.net/uploads/4427284/normal_5fe6ab57dc97b.pdf
    • http://kexedeziferu.sportsontheweb.net/what_is_biblical_hermeneutics.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fojosotum.myartsonline.com/padma_bhushan_award_2020.pdf
    • https://uploads.strikinglycdn.com/files/1967f7fe-4bf8-4ee1-9a11-52fb6e4eb853/86883060603.pdf
    • https://uploads.strikinglycdn.com/files/0d9bd6d8-76bf-48ae-b10c-7a4313a9aa97/how_to_find_initial_velocity_with_x_and_y_components.pdf
    • https://uploads.strikinglycdn.com/files/fc8b5b90-54a3-4b67-b4e4-938b46d1e1db/logokuraw.pdf
    • http://gumomexad.onlinewebshop.net/10001006944.pdf
    • https://uploads.strikinglycdn.com/files/6c62b9e8-a025-471d-8ce4-221ad08e1bc3/xefijosizejed.pdf
    • https://uploads.strikinglycdn.com/files/2beda15a-a183-4d94-b2bc-8fcd86a29b05/how_often_to_change_wick_in_kerosene_heater.pdf
    • https://uploads.strikinglycdn.com/files/919fb441-d67c-4654-a122-aa557ff586b9/85759801709.pdf
    • https://uploads.strikinglycdn.com/files/7c479963-67f4-43a9-9d05-c47b8f0644d3/zatitu.pdf
    • https://uploads.strikinglycdn.com/files/2c765ab6-48e7-49a2-86be-4382954d92f4/wendler_531_results.pdf
    • https://uploads.strikinglycdn.com/files/6e2d60fd-d581-496f-8839-08fb5f729eae/nursing_diagnosis_handbook_free.pdf
    • https://uploads.strikinglycdn.com/files/40611817-0949-433f-a786-4f1572fa2d7c/tikijakupiwowegupupi.pdf
    • https://uploads.strikinglycdn.com/files/58fe4c6f-5928-48e8-9f60-8f8b91f176e7/gamopowepesi.pdf
    • https://uploads.strikinglycdn.com/files/0d6e4dc2-d69e-4e5f-83a8-7106967060da/rekiwabadanavu.pdf
    • https://uploads.strikinglycdn.com/files/31c5fb0d-bcb7-4c3d-bdd9-5d5846469615/what_kind_of_transmission_fluid_does_a_honda_crv_take.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001278d.bin
65631fc9c9f8f208f4ea37b9d8e54c4d90bde1de6cd7d1ac819300a1c23dbc2e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1278D 3816 bytes
font_01_sfnt_off00013523.bin
4694d5d5d0b83fe8d16261ee37b3d6d3be2e66b04243b41bdb5a22b35d3c7bad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13523 5388 bytes
font_02_sfnt_off00014798.bin
afcc4c514379f3155c44f231a744cb29ba11e16b3d714309d9b9205a43c217c9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14798 11132 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.