Malicious PDF — malware analysis report

Static analysis result for SHA-256 1840b36e2841b04c…

MALICIOUS

PDF

77.2 KB Created: 2021-03-24 22:41:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3454b081c860b005f8d3e0e876918118 SHA-1: 7c7a8d47c95a7c8fe8ba4a7779c1903313168d54 SHA-256: 1840b36e2841b04cbc7f7f00ab03a327d327d60f80d16d480d83fca3d71d95d3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that directs users to a suspicious domain, likely for a phishing or malware distribution attempt. The document body, though heavily obfuscated, appears to reference the URL's query parameter, reinforcing the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=8th+grade+us+history+books
    • http://azorocheat1.xyz/who_am_i_child_of_god_lyricsxmz0b.pdf
    • http://komomutuba.22web.org/kasudupepuvatekuja.pdf
    • http://lovechat24.club/flick_shoot_2_download3z6iq.pdf
    • http://luvozoredola.iblogger.org/afcat_question_paper_2020.pdf
    • http://jafoxidulez.mypressonline.com/card_management_system_in_banking.pdf
    • http://dexuposi.sportsontheweb.net/8654007663.pdf
    • http://kodutizaga.mywebcommunity.org/cambridge_checkpoint_english_coursebook_9_free_download.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://vibirokudod.myartsonline.com/katosemuro.pdf
    • https://d1897088-ef6e-4b60-8303-910b4b551fc1.filesusr.com/ugd/4cfbbd_70392acfc0bd40468d92c00f9de6d14f.pdf?index=true
    • https://s3.amazonaws.com/feborobegibew/assassin_s_creed_origins_ign_guide.pdf
    • https://351e5f87-f9e5-4015-92cd-d601692b9ec3.filesusr.com/ugd/a0d0d3_108e3b94fdec43ccbbd6056293adfbd3.pdf?index=true
    • https://1350f94c-8d6f-42b4-8351-24983ad6a49a.filesusr.com/ugd/4aae87_6a795469132a4ce2b1c467a9880c0637.pdf?index=true
    • http://muzudamufuvase.rf.gd/fesobuliw.pdf
    • https://ad9f1622-e3b7-49db-bfef-326c48fb2104.filesusr.com/ugd/a467d2_a5b940ac836a47809e7896b83752c664.pdf?index=true
    • http://xefivaz.epizy.com/mopoxutezujama.pdf
    • https://uploads.strikinglycdn.com/files/37b8d953-1623-4a51-b177-6a7d14e90a4b/loveruv.pdf
    • https://s3.amazonaws.com/wiremeresegikon/ndlea_recruitment_form_2019.pdf
    • https://s3.amazonaws.com/fezenur/29051862193.pdf
    • https://uploads.strikinglycdn.com/files/78895063-6405-445b-8a1a-ae7e1ec6e31c/tomogu.pdf
    • https://uploads.strikinglycdn.com/files/f11bf49e-1c2c-4a58-ba96-f60df2540ce1/24537423972.pdf
    • https://ff536187-e25a-4bd2-965b-ff1113cf40b0.filesusr.com/ugd/bfcccc_97527cba46cd4e7c9ec69d5fef784a32.pdf?index=true
    • https://s3.amazonaws.com/zusevamasor/nebamew.pdf
    • https://s3.amazonaws.com/robumuduluwise/multiplying_decimals_puzzle_worksheet.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000efe0.bin
8e7bea7dcaa270a3a01bae67ba3e469840552b404a2d92a683db599dc95815e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFE0 5460 bytes
font_01_sfnt_off0001026a.bin
ea7ff8440785c74df8f9919d603e39bcfe9c7d947da325b0708ad04f73ebfb39		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1026A 10940 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.