Malicious PDF — malware analysis report

Static analysis result for SHA-256 164f1a83e71155f6…

MALICIOUS

PDF

84.9 KB Created: 2021-03-15 15:50:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0612690df566ed75cceff84f0cc95f35 SHA-1: 787f9dca967a98c637a3be4550b9aacddaa87bd9 SHA-256: 164f1a83e71155f6cb79b0419fb4edc98b27b68143eb2adb431cbdb24fb68e44
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a suspicious domain, masquerading as a search result. This URL is likely intended to lead the user to a phishing or malware distribution site. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=clean+architecture+pdf+github
    • https://cdn-cms.f-static.net/uploads/4446925/normal_6035affbe87d5.pdf
    • http://nosumiva.mywebcommunity.org/standoff_movie_cast.pdf
    • https://cdn-cms.f-static.net/uploads/4478716/normal_6012366d3cd3a.pdf
    • https://static.s123-cdn-static.com/uploads/4391624/normal_5ffe8ac4502a0.pdf
    • http://lozipazom.sportsontheweb.net/robotica_definicion.pdf
    • http://merotudonor.mypressonline.com/emotional_intelligence_test_printable.pdf
    • https://static.s123-cdn-static.com/uploads/4407781/normal_5fe5e1925a891.pdf
    • https://cdn-cms.f-static.net/uploads/4412391/normal_6015201647354.pdf
    • https://static.s123-cdn-static.com/uploads/4482020/normal_6000b24fc64e2.pdf
    • https://cdn-cms.f-static.net/uploads/4420030/normal_604f5abc8d1fc.pdf
    • http://wudaxozibutix.sportsontheweb.net/subtraction_with_regrouping_worksheets.pdf
    • http://beririka.scienceontheweb.net/614538328.pdf
    • https://static.s123-cdn-static.com/uploads/4476939/normal_5fed8f0de624e.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/wupiwupiwot/best_bottom_navigation_library_android.pdf
    • https://s3.amazonaws.com/vizegemawokaxe/ximag.pdf
    • http://dufobirufo.atwebpages.com/rupudaw.pdf
    • https://s3.amazonaws.com/rotowan/minecraft_pe_lucky_block_mod_free.pdf
    • https://uploads.strikinglycdn.com/files/c6c9f69a-a70a-4200-848f-2210ccdecae0/drz400_water_pump_rebuild_kit.pdf
    • https://s3.amazonaws.com/badodemebo/jezaburiwugu.pdf
    • https://uploads.strikinglycdn.com/files/b49c5b5a-4b3d-4e29-9e91-0698d6e6126e/hp_stream_11.6_laptop_case.pdf
    • http://niwurekatexo.atwebpages.com/66567053209.pdf
    • https://uploads.strikinglycdn.com/files/7ce6ec6c-53f4-4c22-9774-fe4d229a68e8/xunaxusogelivifo.pdf
    • https://uploads.strikinglycdn.com/files/4d7ab3a8-a9d5-4a14-ba54-1edb165ed9db/a_technique_for_producing_ideas_epub.pdf
    • http://sulijugofogim.onlinewebshop.net/turtle_beach_elite_800_ps4_slim.pdf
    • https://uploads.strikinglycdn.com/files/da66ea6b-2dcc-415a-ad61-fbfdd3f3d5fd/how_do_you_say_the_angelus_prayer.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fcb9.bin
2ce5a7286efefc5aae27ce1c31b3347e159d00bd30cf97f509a0b7f7d49caffb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFCB9 6440 bytes
font_01_sfnt_off00010cae.bin
65a0cece70045b636b03595db81e5ffb146f576c2546d4755ccd38e65ed1b691		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10CAE 5284 bytes
font_02_sfnt_off00011e9b.bin
00d63d0c472f89b5cdd4b7f9c7debf792a3fab08514a215018e59335206f2a09		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11E9B 10832 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.