Malicious PDF — malware analysis report

Static analysis result for SHA-256 16da5bbafa9a3f73…

MALICIOUS

PDF

69.3 KB Created: 2021-03-31 05:08:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b8575e54850570c8f85b335a0019ce7c SHA-1: ddb070b055baaea84c796965f7be7f2d69bea4ce SHA-256: 16da5bbafa9a3f7381f3b93db1a8d3592c32d8a7eec306cede2af18e9f8189a4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. It contains an embedded URI pointing to 'leonvi.ru', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to a 'modern baybayin chart pdf'. No scripts were extracted, but the presence of embedded URIs and the overall detection profile strongly suggest a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/award?keyword=modern+baybayin+chart+pdf
    • https://static.s123-cdn-static.com/uploads/4419002/normal_5ffc5992bae45.pdf
    • http://xolokeminapi.getenjoyment.net/acuerdo_de_basilea_1.pdf
    • http://gosoxegekiri.mywebcommunity.org/modo_de_produccin_de_la_comunidad_primitiva.pdf
    • http://wemuwetafivaxe.sportsontheweb.net/ruxikelixadadokofovedones.pdf
    • https://static.s123-cdn-static.com/uploads/4392877/normal_6008e824e4b8a.pdf
    • http://mufutekuson.getenjoyment.net/joint_venture_agreement_south_africa.pdf
    • http://tamigome.scienceontheweb.net/65878094538.pdf
    • http://xomunuxeju.sportsontheweb.net/62715073083.pdf
    • http://vikolumubibo.scienceontheweb.net/36464967536.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://acd80754-3b70-42c6-a60f-3489f6261da4.filesusr.com/ugd/f1780b_1beb5bfe65734e6fb8372fb355dd38a5.pdf?index=true
    • https://938a05da-450f-421e-a59b-0448473a402a.filesusr.com/ugd/cb5dea_66886678e9ff419f804aafe79ff53491.pdf?index=true
    • https://s3.amazonaws.com/gudukupir/87840206619.pdf
    • https://uploads.strikinglycdn.com/files/fb6ce4eb-b654-47eb-846a-5ffdb7919cb8/why_milk_and_honey_is_a_bad_book.pdf
    • https://a4758657-6aaa-4003-b0f6-1957e800abfd.filesusr.com/ugd/70c1f8_482892e333e54ecaa2519f532f9e64d5.pdf?index=true
    • https://s3.amazonaws.com/lejivugeleguwod/kellogg_one_year_mba_employment_report.pdf
    • https://591379ed-26d0-4405-baa7-5b8dadede013.filesusr.com/ugd/866ffa_06051810c23a4904a960396d99353c35.pdf?index=true
    • http://namakanexir.atwebpages.com/91022974768.pdf
    • https://uploads.strikinglycdn.com/files/7912d61a-5c11-48d2-9829-471791413d88/jiluzafinoxitudoripifa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c4b9.bin
9194b5441032dac44b824b4fc27266ac1c40809cb3907caaa1cbea1bc0622f9f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC4B9 5068 bytes
font_01_sfnt_off0000d5f4.bin
082e3961d4632bdf6d709e71d0940511e40386e4de684d402a2fbd90b2c65fb0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD5F4 10752 bytes
font_02_sfnt_off0000fa28.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA28 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.