Malicious PDF — malware analysis report

Static analysis result for SHA-256 1899ec8e77314a15…

MALICIOUS

PDF

82.8 KB Created: 2021-03-16 21:21:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 9012c753ed6bae3a7be08640ed463406 SHA-1: b09fc48d13fb70382b97e08e6383b9e85f6e32bf SHA-256: 1899ec8e77314a155153ebb9b2293557e44d507ec2045215f525c61d170209b7
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains embedded URLs, one of which is identified as malicious. The document's content, though heavily obfuscated, appears to be a lure for marriage biodata, directing users to a suspicious domain. The ClamAV detection further confirms its malicious nature, likely as a phishing or trojan delivery mechanism.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.2757

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/award?keyword=marriage+biodata+for+male+pdf+format PDF link annotation
    • http://gdztut.com/78764821435g0xav.pdfIn PDF document text
    • https://cdn.sqhk.co/kefekawit/fhciihe/ori_and_the_blind_forest_break_green_walls.pdfIn PDF document text
    • https://cdn.sqhk.co/sivumazudi/2jjWjhu/smart_card_connector.pdfIn PDF document text
    • https://cdn.sqhk.co/vonezositixi/aiiw9og/maxi_pencil_skirts_for_work.pdfIn PDF document text
    • https://cdn.sqhk.co/pijavagoke/hhjcihW/64173176285.pdfIn PDF document text
    • http://totalcreditcheck.info/153821168551eop7.pdfIn PDF document text
    • https://cdn.sqhk.co/mekibekowufe/hed9hhs/hospital_infection_control_guidelines_icmr.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/devuxuzejozam/western_classical_music_mozart_free.pdfIn PDF document text
    • https://8bd0dbf5-62e0-4684-a95a-1d9666dfa34a.filesusr.com/ugd/e71694_19c35bcdce084195ad45c67dd6373c1e.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/d86bbf03-32cf-4706-8d27-de58ad66c42d/fojibujadaminewumikam.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bd30fcb7-1887-4ed2-b046-07928dc133a6/dolores_cannon_books_free.pdfIn PDF document text
    • https://8b5ac0f3-2bc4-49a6-9a99-2541af31b215.filesusr.com/ugd/f2ef67_b4a464fbf9624e438e30c0c12ec1469d.pdf?index=trueIn PDF document text
    • https://6bc553e5-d0de-4278-827a-c77c8eb32fbd.filesusr.com/ugd/4a6c57_965ac1de68964152858f6f8fa451fd39.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/pidufozu/gesesokezepez.pdfIn PDF document text
    • https://s3.amazonaws.com/jeworurowam/juwasimevuzilud.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f0e3c3e7-c6d2-4e44-af93-7359082d1dda/2018_subaru_forester_trailer_capacity.pdfIn PDF document text
    • https://s3.amazonaws.com/sowewazulejewi/44923142458.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/097f5c2d-2ae8-492a-b7b8-15f4d40a590c/bollinger_bands_indicator_settings.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/abd8f865-1a7f-439f-b1ae-2b2eb0164caf/safety_first_easy_read_ear_thermometer_instructions.pdfIn PDF document text
    • https://bdee3e82-1fe6-4084-b289-f15f5249f83e.filesusr.com/ugd/749937_fd4ed72ddd2f44b28b0448276137930d.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/numegubowalonan/colposcopy_guidelines_canada.pdfIn PDF document text
    • https://s3.amazonaws.com/xilasisefi/1532290082.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000102a0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x102A0 5012 bytes
SHA-256: b3d5b8d398316f038547705c835733d179f2c3368d1ecf7eea5d3c710dc296cd
font_01_sfnt_off000113ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x113AC 11012 bytes
SHA-256: 01c670a4f9fa2d47a07bd4f61d07691bc8ca0a13d3117884ca980bf48f040ce7
font_02_sfnt_off000138f4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x138F4 4324 bytes
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333

Open this report in the interactive analyzer, or submit your own file for analysis.