Malicious PDF — malware analysis report

Static analysis result for SHA-256 1660743226e270d7…

MALICIOUS

PDF

79.2 KB Created: 2021-03-22 14:10:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c2ffdd0d18a907bbba8046f4300b5185 SHA-1: a342aa221447ec07ce79a712eea3e84efcb65d83 SHA-256: 1660743226e270d793c07de195092eb42b8d93079d5528081431383cd2312839
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as a phishing trojan and a machine learning classifier indicated a high probability of maliciousness. It contains an embedded URI pointing to a suspicious domain, which is likely used to host a malicious payload or phishing page. The document body, though heavily obfuscated, suggests a lure related to a product manual.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=guest+charge+pro+2611a+manual
    • https://static.s123-cdn-static.com/uploads/4482415/normal_5febdc48b740b.pdf
    • http://pajuwepubawip.sportsontheweb.net/microsoft_access_365_tutorial.pdf
    • https://cdn-cms.f-static.net/uploads/4490720/normal_6054be9387de0.pdf
    • https://cdn-cms.f-static.net/uploads/4482629/normal_6052dcfd90bbf.pdf
    • https://sujanumijixedi.weebly.com/uploads/1/3/4/5/134501714/jisarave_xujir_dijewojas_puzufeno.pdf
    • https://static.s123-cdn-static.com/uploads/4392474/normal_5ff56623bada9.pdf
    • https://cdn-cms.f-static.net/uploads/4417212/normal_5fe69445c490f.pdf
    • https://xavapijiwo.weebly.com/uploads/1/3/3/9/133997403/1014533.pdf
    • https://kizofirelurok.weebly.com/uploads/1/3/1/6/131606598/ligukuzinitezuzezeme.pdf
    • https://modovepa.weebly.com/uploads/1/3/4/4/134464072/jafototito.pdf
    • https://lipuxavevafip.weebly.com/uploads/1/3/1/3/131398459/lolotalez.pdf
    • http://lomidal.mygamesonline.org/tunopixidorasepefivom.pdf
    • https://static.s123-cdn-static.com/uploads/4366313/normal_60031a3ae73b7.pdf
    • https://static.s123-cdn-static.com/uploads/4413346/normal_5fdcc61ce7c52.pdf
    • https://cdn-cms.f-static.net/uploads/4459478/normal_60241cf74c2ad.pdf
    • https://cdn-cms.f-static.net/uploads/4414672/normal_602a12d0ceb3c.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/62f19063-6f6d-4125-ba13-ca1fddf021fb/jupikugewomubamapagew.pdf
    • https://uploads.strikinglycdn.com/files/ae7ba02f-a34a-4920-a15b-b32702bacbda/81396871868.pdf
    • https://s3.amazonaws.com/rilexazejuzovep/74255117467.pdf
    • https://uploads.strikinglycdn.com/files/2003bd4b-31a9-418d-8310-9f9e19de00dc/jutaxawapusifolofanokeniv.pdf
    • https://s3.amazonaws.com/gawabog/penaxunurixumabadolu.pdf
    • https://uploads.strikinglycdn.com/files/f2833043-501a-4182-a7ea-64957a5a3b7a/how_much_are_tintin_books_worth.pdf
    • http://luzojora.atwebpages.com/dodezulul.pdf
    • https://s3.amazonaws.com/petikamov/muvak.pdf
    • https://s3.amazonaws.com/sowirutelevolur/84196256949.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea21.bin
40ce0bc9b113ef031639604f059b60aa9f1e41b097d60e75bfbf620cccc66306		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA21 2900 bytes
font_01_sfnt_off0000f465.bin
8c1367ffbed26aee3cf6d8b8461a52016ce93cd4b24634df09c02f5d38b48262		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF465 5716 bytes
font_02_sfnt_off000107bb.bin
3fefbf01347bd52ae6e4ed7ea291110c1edc58aacd6911d60311ad23c7c1445b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x107BB 11312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.