Malicious PDF — malware analysis report

Static analysis result for SHA-256 17607aecf7468bb4…

MALICIOUS

PDF

226.0 KB Created: 2021-05-01 15:13:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: cb3ef0c72537aee3532a6edd2d462378 SHA-1: ee72027e336a9d103cf83d713c1faf6373cdec7a SHA-256: 17607aecf7468bb40c138274410d39a5fd436a3b7afa2b376b5a80eba1849b8d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged as malicious by ML classifiers and ClamAV. It contains an embedded URI pointing to a suspicious domain, vilenefex.ru, which is likely used to host a phishing page or download a second-stage payload. The document body appears to be garbled, but the presence of the malicious URL and the overall detection strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9960

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=mutual+funds+for+dummies+8th+edition+pdf PDF link annotation
    • http://nujijaj.getenjoyment.net/52582746946.pdfIn PDF document text
    • http://dalidusiz.mywebcommunity.org/skf_angular_contact_ball_bearing_catalogue.pdfIn PDF document text
    • http://reveruverof.medianewsonline.com/cambridge_igcse_ict_coursebook.pdfIn PDF document text
    • http://vevaroda.scienceontheweb.net/48523906469.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://6593eeda-10fe-4128-810f-cbbc79f0a4f8.filesusr.com/ugd/c0a4bf_66abc8c64a764002b3ed1141373c0788.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/3513d666-0e36-44bc-b5af-d472a8a552ac/xozutero.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aa9dde1d-aeb9-4c53-8614-740c233f295c/36892133781.pdfIn PDF document text
    • https://ee6e56e8-c390-49d2-810b-d4defef8b9c1.filesusr.com/ugd/eda187_ff7fcd5f76e44cceabec4145df71e028.pdf?index=trueIn PDF document text
    • http://rizivubonulej.atwebpages.com/jigobifedapafa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a13daedf-b386-4a28-ac7e-ca982c25f511/1149356287.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dad0ffe7-4849-40dc-8fbd-afb81496e84a/how_to_use_badger_insinkerator.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ed558946-1157-445c-8511-e209c81a0524/canon_pixma_mg6320_ink.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ff1ea170-a717-4405-b3d6-0e2d20e639a5/the_watsons_go_to_birmingham_1963_compare_and_contrast_kenny_and_byron.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6923f207-a61a-4179-9ce3-932acf60d3b9/madame_bovary_part_3_chapter_5_summary.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6206ac17-3898-4bb5-8000-968f44879a03/saxukumenufux.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5a90eb22-7adb-4023-9dda-4fd8b165beac/can_you_use_chi_keratin_mist_on_dry_hair.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bfb14bed-a9a8-40a0-b572-d2ff2511e23b/61166534472.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c25ed004-3adb-489b-bd36-72590a6bdbea/msi_n1996_gpu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00032130.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x32130 5480 bytes
SHA-256: c9f9af75c42e54613f9d3eeb92e2417a875df2f735083716405eabc13cf30202
font_01_sfnt_off000333b6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x333B6 13108 bytes
SHA-256: efab3e3aa60c071e711e1098a9b6b75820b1cbec5caecd7a7e43d8db17d06a99
font_02_sfnt_off00035f0c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x35F0C 16960 bytes
SHA-256: 96505283c6a7688d92692cfb50e8934ab2edc6d8bbc909bfe3eab4caf11100e5

Open this report in the interactive analyzer, or submit your own file for analysis.