Malicious PDF — malware analysis report

Static analysis result for SHA-256 18b5fedb8c0ef549…

MALICIOUS

PDF

79.3 KB Created: 2021-03-03 10:08:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3cf73e453b1935402c4d04a1049e4403 SHA-1: d03be083de14cb6eef7470067f452b6e560ba5bf SHA-256: 18b5fedb8c0ef549a2ab838babd170bec6c24a7f8a272abbcb93261ec7f261b5
76 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF document flagged by ML classifiers as malicious and exhibiting characteristics of an advance-fee scam. It contains an embedded URI pointing to a suspicious domain, likely intended to lead the user to a phishing or malware download site. While no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to trick the user into visiting a malicious external resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/award?keyword=live+life+golden+we+were+golden
    • http://itwomen.space/how_to_pair_2_doss_speakers3ab5y.pdf
    • http://retys.space/what_is_newtons_laws_of_universal_gravitation0ujvs.pdf
    • https://cdn.sqhk.co/ledazukogim/izjbgh6/black_widow_movie_release_date_nz.pdf
    • https://cdn.sqhk.co/parikozug/gegfM5l/thomas_runyan_md_brunswick_ga.pdf
    • http://busevabafumoje.iblogger.org/venice_vaporetto_route_map.pdf
    • http://theraisins.pro/troy_bilt_pony_drive_belt_sizef0zc6.pdf
    • http://gta-msk.ru/pupuzeruxibbhapo.pdf
    • http://lessonsonline.site/video_downloadhelper_firefox_youtubegri3u.pdf
    • http://idealica-italiauficiale.website/reported_speech_imperative_sentences_worksheetss79ez.pdf
    • http://pihodze.com/kikitefarurovidony1eem.pdf
    • http://thepropheticapp.com/surovekurotetulna9sd.pdf
    • http://zatoboyvibor.fun/nosozezu8yb3.pdf
    • http://kadafujefofamu.22web.org/what_is_subject_of_quran.pdf
    • https://cdn.sqhk.co/jazumagefo/ihgiMjf/ducks_unlimited_banquet_2019.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://gudinomid.rf.gd/tumidisoragaxejivatujuwor.pdf
    • https://s3.amazonaws.com/feborobegibew/19339258096.pdf
    • http://pulupalu.epizy.com/54078268531.pdf
    • http://gepuwuvezu.epizy.com/answer_key_2019_ctet_paper_2.pdf
    • http://bulujulu.rf.gd/27913577615.pdf
    • https://s3.amazonaws.com/rizezobabub/case_simulator_2_pc_free.pdf
    • http://towixamum.epizy.com/46078568690.pdf
    • http://xamufalifab.epizy.com/diferiwasupuvax.pdf
    • https://s3.amazonaws.com/jagux/jin_bts_tonight_lagu.pdf
    • https://s3.amazonaws.com/xunilukegez/react_axios_binary_file.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb5a.bin
ddf6e7b009245a182a463b4816c4504a0118f7d556e00dff005d5ce466392e9e
pdf-font-stream PDF embedded font (sfnt) at offset 0xFB5A 4780 bytes
font_01_sfnt_off00010bc8.bin
d6299b9402a8ddc19f4eff3165269cbac1d80d96603239565ef10b1c3a641fbd
pdf-font-stream PDF embedded font (sfnt) at offset 0x10BC8 10472 bytes