Malicious PDF — malware analysis report

Static analysis result for SHA-256 1aaaa4f4de4eff84…

MALICIOUS

PDF

79.7 KB Created: 2021-03-02 23:15:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12
MD5: c7d3b19427d71983e00ca9ae0fa60a27 SHA-1: 2581ac851e8a11d694f102ebf72a41613ccfa1e4 SHA-256: 1aaaa4f4de4eff842a572da68ebcb6dd0dce304ed412981024181d9d3ab29a9e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, with heuristics indicating the presence of an external URI. The document body, though heavily obfuscated, suggests a lure related to health conditions. The primary malicious indicator is the embedded URL, which likely leads to a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=enfermedades+relacionadas+con+el+sistema+endocrino+que+afectan+a+la+poblacion+venezolana PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4446492/normal_600d8d5ba987f.pdfIn PDF document text
    • http://arfesopt.com/a105_material7yuld.pdfIn PDF document text
    • http://lnstagramsupportingcenter.com/fedololukumozafefisebof0s1sj.pdfIn PDF document text
    • http://wirelessinfo.ru/duck_hunting_season_2020_louisiana541me.pdfIn PDF document text
    • http://smeshnoykir.space/zitiwigivixufudukowur5yz01.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365998/normal_5fdc57fc2748e.pdfIn PDF document text
    • http://fixmarker.fun/sejagejumizixazaljn8xu.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4479433/normal_5ffad0e3d99e8.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4473963/normal_6000f62f8f24c.pdfIn PDF document text
    • http://vashe-zdorovie.xyz/kokia_fukurou_sheet_music58qc8.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4470532/normal_5fc7d2b85a4b7.pdfIn PDF document text
    • http://otshelnik.net/myocardial_infarction_nice_guidelines_prevention6qyfg.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4501645/normal_5fdeb4f4c6e4f.pdfIn PDF document text
    • http://2022god.com/watch_twilight_breaking_dawn_part_1_free_online_full_movie79rdv.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/vasofirida/alanis_supposed_former_infatuation_junkie.pdfIn PDF document text
    • http://goseletew.epizy.com/android_app_development_programming_language.pdfIn PDF document text
    • https://s3.amazonaws.com/kigavanus/21142092902.pdfIn PDF document text
    • https://s3.amazonaws.com/viromibukoleliw/29202554549.pdfIn PDF document text
    • http://kivekedifewu.rf.gd/zigujipetatuzajaju.pdfIn PDF document text
    • https://s3.amazonaws.com/tesodagiwor/pusulobepukokigewoxetovi.pdfIn PDF document text
    • https://s3.amazonaws.com/kozibowisenatu/bavotunalejusuxe.pdfIn PDF document text
    • http://roxipumemo.rf.gd/how_to_assemble_ingenuity_automatic_bouncer.pdfIn PDF document text
    • http://mojorudo.epizy.com/4_tazas_de_harina_cuantos_gramos_son.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4d9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF4D9 5632 bytes
SHA-256: a15f952bd568215bff4edec89943b950232f0fa8320217f5f165aafb94591e09
font_01_sfnt_off000107f3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x107F3 11632 bytes
SHA-256: 096ef56fafca198be9e58597d4fc4213feb8caa5df06f0d1760aea1f720f0bac

Open this report in the interactive analyzer, or submit your own file for analysis.