Malicious PDF — malware analysis report

Static analysis result for SHA-256 1673ac1c7a5f35b3…

MALICIOUS

PDF

193.4 KB Created: 2021-03-27 22:20:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d03f980ea818febeea7274d17a5f67c8 SHA-1: 2504aacf003dce57d17a5c5b784e2adcc327113a SHA-256: 1673ac1c7a5f35b3031408f54773da9462c98d66e22131476ebf4459db894959
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains an embedded URI pointing to a suspicious domain, likely intended to trick the user into downloading further malware or visiting a phishing site. The document body, though heavily obfuscated, contains text that appears to be a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/123?utm_term=asocijacije+svecana+konj+uniforma
    • https://static.s123-cdn-static.com/uploads/4423428/normal_5ff2249fb9d87.pdf
    • http://gudutisiluzew.mypressonline.com/algorithms_4th_edition_sedgewick.pdf
    • http://nomenowunesazoz.scienceontheweb.net/loctite_263_msds.pdf
    • https://static.s123-cdn-static.com/uploads/4384461/normal_6005f3c41632a.pdf
    • https://cdn-cms.f-static.net/uploads/4416495/normal_60149034a768d.pdf
    • https://static.s123-cdn-static.com/uploads/4474170/normal_6005f8e4b2faf.pdf
    • http://lisexodufebe.22web.org/callan_method_stage_9.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/vebisop/transformations_on_coordinate_plane_worksheet.pdf
    • https://63c5840e-267c-49ed-94d3-fc9f9d8b9c0b.filesusr.com/ugd/8c5bc8_b4540ba1a1614d36b211eee7817fbf7d.pdf?index=true
    • http://weverikovufom.rf.gd/betowudolaligibikode.pdf
    • https://2a983b51-2e13-4971-8c1f-a5bca3ab4353.filesusr.com/ugd/e1a791_ebfb3428512042e0a097cb508fb48c9a.pdf?index=true
    • https://s3.amazonaws.com/pazovugal/dizupesabebole.pdf
    • https://abbf68a8-5b21-4996-91be-11266bd273ed.filesusr.com/ugd/9374a7_0bdaa8a03b254b8aa326ac55487530f1.pdf?index=true
    • http://vupiwenuwog.epizy.com/haridwar_tour_guide_video.pdf
    • https://s3.amazonaws.com/wolina/how_to_grill_burgers_on_cuisinart_griddler.pdf
    • http://ximuxulizi.myartsonline.com/64892107953.pdf
    • https://d1b6b380-f15b-462b-86b5-0b089ba7d90d.filesusr.com/ugd/f99a33_2650da0c6853409ca22845e29642a390.pdf?index=true
    • https://s3.amazonaws.com/lawakux/43745542033.pdf
    • https://69b3109a-7cce-4514-9193-d2106d9976ab.filesusr.com/ugd/3c2969_02d8701f07e44b7ba777d35ccef54bac.pdf?index=true
    • https://s3.amazonaws.com/kovilowab/plot_of_dr._zhivago.pdf
    • https://s3.amazonaws.com/xutomoxu/how_to_connect_bose_acoustimass_module_to_tv.pdf
    • https://s3.amazonaws.com/xezujuxoz/50606704142.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002bd40.bin
81b589a3650daecf62ea0a8a3e809fbfe35fc0a0a42f7a72c603209ea1b04bc3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2BD40 5184 bytes
font_01_sfnt_off0002cee3.bin
e5d1170bc28fad30ffb4932f214fade25eda6138127ce62095b61294886e7487		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2CEE3 12308 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.