Malicious PDF — malware analysis report

Static analysis result for SHA-256 18779d7a2404bcfd…

MALICIOUS

PDF

307.8 KB Created: 2021-04-12 18:55:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f35a249f6d2bf4f54e5d4576b57e6aff SHA-1: aa8513060f7fee37a91fcf4402254d16edb6f988 SHA-256: 18779d7a2404bcfd393fff8a2e8dfa1c7e276c873c6d0950b91792501024ed19
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating an external URI and is flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. The embedded URL points to a domain that is not confirmed benign, suggesting a phishing or malware distribution attempt. Although the document body is heavily obfuscated, the presence of the malicious URL and the detection signatures strongly indicate a phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9771

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=korean+alphabet+charts
    • https://cdn.sqhk.co/kilatelazobe/jeiafha/ps3_controller_n64_emulator_pc.pdf
    • http://beririka.scienceontheweb.net/tratamiento_del_accidente_cerebrovascular.pdf
    • https://static.s123-cdn-static.com/uploads/4366024/normal_5fe2caca265e4.pdf
    • https://cdn.sqhk.co/lanabeja/fDhgegg/water_slide_rentals_miami.pdf
    • https://cdn-cms.f-static.net/uploads/4421040/normal_606c32ce489e1.pdf
    • http://lafutib.sportsontheweb.net/anemia_aplasica_pediatria.pdf
    • https://cdn-cms.f-static.net/uploads/4454813/normal_60309dcf42555.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.thdl.org/http://www.thdl.org/Tibetan
    • http://www.daltonmaag.com/
    • https://c245485c-e1a4-4c5a-9a2a-c465a95e53c8.filesusr.com/ugd/25f824_a74769c1a8974b03a982b7c282afcf83.pdf?index=true
    • http://gevejonitu.onlinewebshop.net/how_to_quick_ratio_analysis.pdf
    • https://a19d597f-2220-41b3-9459-688249e8a20b.filesusr.com/ugd/f19f53_7e9e0a2dde3c43f896854fe5906bfb2c.pdf?index=true
    • https://f904ef53-caa1-4f0f-8a97-c50675c03ece.filesusr.com/ugd/2f8cea_1784eb16b929436c834197c0d27cf1cf.pdf?index=true
    • https://uploads.strikinglycdn.com/files/8374ad3f-187b-4c83-a2d5-5d0d80100e00/grade_5_mathematics_printable_worksheets.pdf
    • https://0f0532cb-4478-41f9-91a1-cf277c4732ec.filesusr.com/ugd/8acad3_9e7e72380fd940b68941ae3488c2f662.pdf?index=true
    • https://69a21580-3c80-4f81-8097-1ec0bc18215d.filesusr.com/ugd/bd7df1_7f96b116dded4369aeb3a4028c9f3b54.pdf?index=true
    • https://f07eb630-23ff-4298-a1df-d7940f1ba2dc.filesusr.com/ugd/097a5b_40739af7c0154adeb92d943dd5246983.pdf?index=true
    • https://uploads.strikinglycdn.com/files/9185083c-56cc-4bcf-aa37-41df0149d483/92856596847.pdf
    • https://34e223d5-b18a-4f89-96b3-7c58aa965d90.filesusr.com/ugd/440e29_658c675bbe804ee1aaa1456ffa1b9d09.pdf?index=true
    • https://01c4c9a3-ee74-4db9-a65d-799443b8dbf1.filesusr.com/ugd/a64c8c_0ae889dfd2c5496692aba4afff88e442.pdf?index=true
    • https://6e229dea-1f83-4be8-8cd3-388eabd4f5e3.filesusr.com/ugd/1cfe37_376529668a5a4c82b628e46d1282cb3d.pdf?index=true
    • https://ef2e072a-e8a2-4438-804d-cc750be2e2f6.filesusr.com/ugd/6a22cb_8de2c7f471e148b0bbe55fe6fee09bef.pdf?index=true
    • https://uploads.strikinglycdn.com/files/4b6c5d46-e0f7-406b-a036-2b6a4cfcf752/32519940117.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.htmlTibetan
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002c169.bin
9069c573ccb3d832f0e18598a45d44fff5c2f2b3632a72fa2922e9ee664a2300		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2C169 147248 bytes
font_01_sfnt_off00043d1c.bin
3d3e327917f6ea833e1e28618f17c2a1407d78081793b29f68f488999a043086		 pdf-font-stream PDF embedded font (sfnt) at offset 0x43D1C 4868 bytes
font_02_sfnt_off00044d93.bin
ea35808a71e97665288bb224b1d8c67e501d47d7e55d704b0c8bdbe75480465a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x44D93 8532 bytes
font_03_sfnt_off00045e06.bin
b8194f05f124a8f3ae84941902090a8f0d6cc45af62bd74ed898eb498d89a787		 pdf-font-stream PDF embedded font (sfnt) at offset 0x45E06 20596 bytes
font_04_sfnt_off00049c19.bin
5b7811194be551f8240c32daf2150f1707a7dff3a8879c22c3828a206df80b40		 pdf-font-stream PDF embedded font (sfnt) at offset 0x49C19 16380 bytes
font_05_sfnt_off0004b22e.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4B22E 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.