Malicious PDF — malware analysis report

Static analysis result for SHA-256 163516fda6e7bcc4…

MALICIOUS

PDF

245.1 KB Created: 2021-03-15 13:58:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 923a6450310a1879199088a5e49edc40 SHA-1: 9c99d7f7b63725f284dc934584594eb2c4980af6 SHA-256: 163516fda6e7bcc465b82bd70931c9ecc799a1b330c8ce2a43e0e6b5f5db084d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF file flagged as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. It contains an embedded URL that appears to be a lure for downloading a PDF, likely a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, suggesting it was generated programmatically to appear as a legitimate document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9921

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/award?keyword=blades+in+the+dark+pdf+free
    • https://gumabudisipinef.weebly.com/uploads/1/3/2/7/132712006/8361414.pdf
    • https://static.s123-cdn-static.com/uploads/4460060/normal_5fe065d983e04.pdf
    • https://cdn-cms.f-static.net/uploads/4418379/normal_603d60506c991.pdf
    • https://pabaxovazat.weebly.com/uploads/1/3/4/3/134323574/goveka.pdf
    • https://kupefuvewugixo.weebly.com/uploads/1/3/4/8/134849821/1924297.pdf
    • https://jirewolekaza.weebly.com/uploads/1/3/4/3/134387643/306d4d401c.pdf
    • https://sepuvoguzunisam.weebly.com/uploads/1/3/4/4/134488558/salubikowurovizemu.pdf
    • https://vupixesit.weebly.com/uploads/1/3/2/7/132740805/bunewuvelabomet.pdf
    • https://xawewidijaxiju.weebly.com/uploads/1/3/4/2/134266046/14db54a.pdf
    • https://cdn-cms.f-static.net/uploads/4490377/normal_603565409a413.pdf
    • https://ratopavitakam.weebly.com/uploads/1/3/4/4/134460251/tixofe_mewekukafak.pdf
    • https://cdn-cms.f-static.net/uploads/4411922/normal_6046be5cc7bc0.pdf
    • https://cdn-cms.f-static.net/uploads/4386837/normal_604ec57de4918.pdf
    • http://fontawesome.iohttp://fontawesome.io/license/
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://39c1d623-eccb-4af0-a86a-15328a2d61f9.filesusr.com/ugd/3cb6cb_9284f4d45e1c428f99bf7d15d3807b55.pdf?index=true
    • https://s3.amazonaws.com/zozofufulolig/sitet.pdf
    • https://s3.amazonaws.com/limepusotanal/asking_and_giving_directions_in_english.pdf
    • https://uploads.strikinglycdn.com/files/18740a15-4c87-4c34-9ff9-f76c7219c453/juvaxuxisodoxur.pdf
    • https://uploads.strikinglycdn.com/files/7b961565-5dd1-49a7-b909-4618ae9d9474/gezigatugukokilufevabux.pdf
    • https://d8d078ea-10ec-4787-8e21-ef6e32b87a24.filesusr.com/ugd/8f6098_8e3f1bd46ae54cceb6accfc14f64f4bd.pdf?index=true
    • https://s3.amazonaws.com/dikobepibelun/fixed_asset_management_policy_template.pdf
    • https://24a70dd4-b549-4b9e-9c0a-6eea45ab85ad.filesusr.com/ugd/ab0c63_42d27993bcac4f069381dae39a4ac2c3.pdf?index=true
    • https://s3.amazonaws.com/xupizewuxere/73110900636.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00036a2d.bin
4d48c425ebef90c2d02d06bcf645bfe766804625a466b4613fba07e24684c3c9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x36A2D 1768 bytes
font_01_sfnt_off000372d4.bin
53cb990b6e81c843545885655f424f7fa19997a14bfacd81c64598694f0e6a15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x372D4 5240 bytes
font_02_sfnt_off000384a4.bin
b89fa42f76156ffc784535a605479ecd39f076a9e42ccc834add6598a48eba74		 pdf-font-stream PDF embedded font (sfnt) at offset 0x384A4 12496 bytes
font_03_sfnt_off0003ae86.bin
5b0d2701ab39d2f69c66d7d16c60d8db0b323aa0832947137e757b5401d27330		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3AE86 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.