Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a8f757850cfa7b2…

MALICIOUS

PDF

86.9 KB Created: 2021-03-15 07:54:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0c6ca17cf2bcd48e6b11cc77bccdb4e8 SHA-1: 40cf718e975f6f18f386db7de99ded6307188ea8 SHA-256: 1a8f757850cfa7b2c22440f9df4e05b49425369755efc9fe7abcab3ca1f23024
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, with a critical heuristic firing for ClamAV detection. It contains an embedded URI pointing to a suspicious domain, suggesting a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains text related to 'The house on mango street chapter 17 quotes' and the wkhtmltopdf application, likely used as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=the+house+on+mango+street+chapter+17+quotes
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://bofejurereme.rf.gd/retufi.pdf
    • https://5e3b32e6-a537-4a58-a531-ef303a468713.filesusr.com/ugd/120874_75fb2bdcf46c420c995ec5b39f273cc8.pdf?index=true
    • https://uploads.strikinglycdn.com/files/f380c5d8-e437-4b36-b370-a3c78cfa0b53/bangla_to_english_translator_software_for_pc.pdf
    • https://d8d691c7-cf48-432b-bece-a54604b57851.filesusr.com/ugd/1e3a4b_ee9c3fa7c3b540178ec2827ed835e779.pdf?index=true
    • http://wivoruremuwun.rf.gd/administrao_pblica_conceitos_introdutrios.pdf
    • https://69df74eb-9f83-488d-97bb-abb55063df61.filesusr.com/ugd/f34323_3bb5ff92c4c84aa88a27ba415226bb6a.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b68cb803-1119-47dd-8b1f-52efc90b7df5/rakubologusogeluwowixo.pdf
    • https://s3.amazonaws.com/zidenigad/16217178888.pdf
    • https://12c9c681-cafc-4f88-93da-cb6f471fd49a.filesusr.com/ugd/f09a9d_54a5097fb3df46cea8978d0ae7e07e64.pdf?index=true
    • https://s3.amazonaws.com/biwuwukesazef/finebujoxolodir.pdf
    • http://woruwewuxiv.rf.gd/practical_thermal_design_of_air_cooled_heat_exchangers.pdf
    • http://puxetixunelotaz.epizy.com/bengali_detective_movies_free.pdf
    • https://4123e755-5e7e-4fb8-b167-49ba90d37259.filesusr.com/ugd/fd3290_8cd0fa1ebdf844bdacedf60dca933a17.pdf?index=true
    • https://8d928d4c-4e32-4dc6-8093-d383c90b3cca.filesusr.com/ugd/b5d49c_b3ab85ab6f054ad4b2fa472e55e9e7ea.pdf?index=true
    • http://nufeluzuxaluw.epizy.com/swisher_44_mower_parts_diagram.pdf
    • https://s3.amazonaws.com/bededuxotulapil/pifurafenaramagodijixo.pdf
    • https://c63359c4-faa5-40af-ad11-254ddd3d100c.filesusr.com/ugd/838c33_3d23312a4a264f1faab655fea0a9fa0e.pdf?index=true
    • http://fufamiwebo.epizy.com/archer_c5_openwrt_performance.pdf
    • https://0298dc5a-7924-4276-8279-06452a5288da.filesusr.com/ugd/b30cf0_423295f2688a4f0e8ef1ddcb375968a5.pdf?index=true
    • https://s3.amazonaws.com/wiremeresegikon/tofaw.pdf
    • http://tixisodid.epizy.com/pelufifuvoso.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000111ef.bin
6f7bb89851ecda77936821c1a352d028a8f1cf1b06881c6cea43af36222819c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x111EF 5520 bytes
font_01_sfnt_off00012496.bin
17af4ac1f4a13a0392a0fbb3f01feb2afa476f781a12cc7aa1767718c05d40a9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12496 11912 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.