Malicious PDF — malware analysis report

Static analysis result for SHA-256 183090f82ed1eb4e…

MALICIOUS

PDF

78.3 KB Created: 2021-04-14 12:41:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b6807783c7c56f0b0b4f7355636829a9 SHA-1: ae22e85d85ff6358d0d0ab5feccaf158181be37c SHA-256: 183090f82ed1eb4e4ffa16309ef8b2c2d9751b48dcadda1d0c0e4721c303bfcb
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to a search query, aiming to trick the user into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=what+does+flo+mean+on+sundance+spa
    • https://karopudalel.weebly.com/uploads/1/3/4/8/134881347/zineli_wovukedokomet.pdf
    • https://kivobuduzuv.weebly.com/uploads/1/3/0/7/130739084/tuvigizetesupid_gedujofowu.pdf
    • https://cdn-cms.f-static.net/uploads/4503387/normal_605a12d86262d.pdf
    • http://lewizakadogera.iblogger.org/22037038583.pdf
    • https://cdn-cms.f-static.net/uploads/4499958/normal_606e1ec921fef.pdf
    • https://barutonujumajom.weebly.com/uploads/1/3/0/7/130739232/7977731.pdf
    • https://vorexumezekadan.weebly.com/uploads/1/3/0/9/130969740/2c15d5d396.pdf
    • http://terasivox.22web.org/kabbalah_for_beginners.pdf
    • https://cdn-cms.f-static.net/uploads/4392463/normal_601c03b1454d6.pdf
    • http://bivemipizejon.22web.org/11372245313.pdf
    • https://cdn-cms.f-static.net/uploads/4403429/normal_604475068f63e.pdf
    • https://cdn-cms.f-static.net/uploads/4403531/normal_6057b6ed854c4.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://venakato.epizy.com/64968754588.pdf
    • http://bifelizebov.rf.gd/62288624998.pdf
    • http://lokimutopilar.epizy.com/bartholinite_et_grossesse.pdf
    • https://2ffa788b-df2f-461f-b9c5-573bec542745.filesusr.com/ugd/374ce0_16778aa8cb92496fb762caed2eb550f2.pdf?index=true
    • http://rozasazi.epizy.com/87282314993.pdf
    • http://birifamabaxum.rf.gd/how_much_does_a_honda_rebel_300_weight.pdf
    • https://5926284e-b61c-4ed0-95e5-27b9feedd2c3.filesusr.com/ugd/50c35f_19cc74c9cf564e61b0af859246ec6fdb.pdf?index=true
    • http://nanoxamovafosox.epizy.com/futura_pt_bold_font.pdf
    • http://xodojes.epizy.com/kadoxanosawewopexowo.pdf
    • https://189c2d36-84ff-4b81-9465-96c33c1d3b91.filesusr.com/ugd/35ddae_51cc1756f08546b79192a3fa86567b07.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f16f.bin
f4fe18860bd42624046d87bd881970906b92faf72216ff4c13c25095801cfeb5
pdf-font-stream PDF embedded font (sfnt) at offset 0xF16F 5312 bytes
font_01_sfnt_off00010371.bin
6f25df58f40fb63467ed47537b3975547b9f406543f53d0362117502cdd588bf
pdf-font-stream PDF embedded font (sfnt) at offset 0x10371 11236 bytes