Malicious PDF — malware analysis report

Static analysis result for SHA-256 195de7508bff5b12…

MALICIOUS

PDF

75.0 KB Created: 2021-04-05 23:01:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 2e3ae33f688da1687b39a3bc33f2e504 SHA-1: 9b8897a51a716879f43fd042cdc733f397e06a5c SHA-256: 195de7508bff5b126c6784ee7050438fde516149cebacb3ad39a0bda310d0787
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier. It contains an embedded URL that leads to a suspicious domain, likely intended for phishing or malware distribution. The document body, though heavily obfuscated, appears to contain text related to volcanoes, possibly as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=what+materials+are+shield+volcanoes+composed+of PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4417645/normal_5ff525602f133.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4383698/normal_5fcfee8bdad5d.pdfIn PDF document text
    • https://cdn.sqhk.co/dobexesi/jhchihd/jump_start_car_kit_near_me.pdfIn PDF document text
    • https://cdn.sqhk.co/kinanekoxo/jfHjh4B/dawnbringer_riven_statue.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417525/normal_5fecc0a442fe7.pdfIn PDF document text
    • https://cdn.sqhk.co/raxinosi/dvhjic3/pipovoluwazafo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415937/normal_60350b82a9a69.pdfIn PDF document text
    • https://cdn.sqhk.co/juvanejejuwo/eigiUC7/road_trips_during_covid_canada.pdfIn PDF document text
    • https://cdn.sqhk.co/suzironanes/hfjdggb/lemonade_recipes_for_a_crowd.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4455195/normal_5ffad2edb9c29.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/92e61e04-c8d5-4717-bcf7-a06ad5ecfd9e/gilupesagaxadazusonit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/214a9b4d-5c1e-4ef4-ba4e-d301b17f63a8/lenormand_cards_meaning_whip.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/82c1f4b7-949f-4026-ae06-c405ad6ae968/how_to_contact_uscis_vermont_service_center.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f41c0dcb-3a9f-4980-8757-25d80a864d53/what_is_research_interest_in_cv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/858f3ce7-14ea-45fc-aa04-a1a730761178/traductor_de_espaol_a_ingles_fotografa.pdfIn PDF document text
    • http://puzazodigeza.epizy.com/25059494675.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4432938b-f617-406b-a1c4-293a5b52f2ea/65038883439.pdfIn PDF document text
    • http://posufimiru.rf.gd/11191952444.pdfIn PDF document text
    • http://tivekanudoz.rf.gd/assembler_deux_mac.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d6760800-8b34-4cff-9bf3-b2d315d6a136/30009279722.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e73c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE73C 5468 bytes
SHA-256: e0ebee2ceeb014496ba68553ab8002baf49930b63bdd24f8fe11fb20772c60df
font_01_sfnt_off0000f9bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF9BB 11044 bytes
SHA-256: 24b679cae995276a1b642223754f810f0d7ac11e2b042b15348dd895c30b6129

Open this report in the interactive analyzer, or submit your own file for analysis.