Malicious PDF — malware analysis report

Static analysis result for SHA-256 18f9484389d019f3…

MALICIOUS

PDF

85.2 KB Created: 2021-04-07 23:25:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8e21cd50269662e87d9dc921c141e846 SHA-1: 9bdf492aad6a01ecc58c852631b989dca166b419 SHA-256: 18f9484389d019f3af51b7c7895cf35c399691420c17ca550b8c29929ddf3b2f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://xezojetit.ru/123?utm_term=counselor+school+report', which is likely used to redirect the user to a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to a 'Counselor school report'. No scripts were extracted, but the presence of external URIs and the overall detection profile strongly suggest a phishing or downloader attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/123?utm_term=counselor+school+report
    • http://toxipoxekej.medianewsonline.com/yasin_sharif_download_free.pdf
    • http://fastcreditcheck.info/44306927563cnj7q.pdf
    • http://euroshopmn.space/how_do_i_become_esl_certified_in_texasjij8a.pdf
    • http://gatofupimekow.mywebcommunity.org/13820178276.pdf
    • http://zarabatyivat.ru/82314447311rsjkw.pdf
    • http://souve.me/mijuzejezorodelavegizum8ay82.pdf
    • http://gidujoluj.mypressonline.com/gomavazononamegawi.pdf
    • http://mofobawosenej.mygamesonline.org/basic_electronics_engineering.pdf
    • http://psylath.com/contractions_worksheets_grade_4tj0ia.pdf
    • http://kafalukuwemi.mygamesonline.org/kidepet.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://e21f0dd0-e693-4a2a-aa38-6cab66162128.filesusr.com/ugd/34eed6_ef0495a85f0b4f9b82912153fee95ee2.pdf?index=true
    • https://b73b9701-b1df-43be-b031-73419f87697c.filesusr.com/ugd/bfbd96_141c4710986e4aa6b2c3a0d3131f94e4.pdf?index=true
    • https://724418e0-3ace-43c1-abd8-628b4820fc71.filesusr.com/ugd/6df952_2c75c734265f4b06946660548ad1da3a.pdf?index=true
    • https://98cdd5c5-c43e-49eb-9373-39517e896cbb.filesusr.com/ugd/90661f_fda8f90f6f6d4608916aa37a2c4094d8.pdf?index=true
    • https://uploads.strikinglycdn.com/files/061c0167-5fc4-4217-b94f-ec6f8d358500/1830875554.pdf
    • https://uploads.strikinglycdn.com/files/a294bd44-2185-48e1-83b2-16e9d5a03995/wolodinafumi.pdf
    • https://69868269-04aa-4a0d-8379-1371762fd556.filesusr.com/ugd/d8beff_b82a0c136cd24fd092dbc692d7282d95.pdf?index=true
    • http://netawuwimirixor.onlinewebshop.net/best_funny_political_quotes.pdf
    • https://uploads.strikinglycdn.com/files/6e07a3bf-7e4e-40f8-a9de-215cf6d28de7/what_is_the_best_cheap_champagne_for_mimosas.pdf
    • https://uploads.strikinglycdn.com/files/8d1e05b2-e52f-43eb-927d-437fd1eed4db/mabozixuxevosadoxaf.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fd37.bin
ff760971560545059d36c4467ca6c25f5c48b7a7c947cbcad2871410b9435e35		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD37 4716 bytes
font_01_sfnt_off00010d38.bin
514eb48dac6d691afc2603274eb925b41e2a9cab5f4ef5ac557df1d1237ea5a2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D38 11012 bytes
font_02_sfnt_off000132e4.bin
d7dbcefd5a9d087f9dbd48d87e5b82950a900fa0f666d4a1f78598b818f3f613		 pdf-font-stream PDF embedded font (sfnt) at offset 0x132E4 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.