Malicious PDF — malware analysis report

Static analysis result for SHA-256 1b0bfafd49234307…

MALICIOUS

PDF

77.4 KB Created: 2021-03-14 13:36:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4e8bea1a85b8becde69d93171c45539d SHA-1: 693f63de2beb59192178d0bab042f4c4db39db33 SHA-256: 1b0bfafd492343072b7a241a7ba8f44ea4a021c853273dc83e35f9e740f4d50f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ML classifiers and ClamAV. It contains an embedded URI pointing to 'https://dafemum.ru/wix?keyword=glaciers+worksheet+pdf', which is likely used for phishing or to download a secondary payload. The document body, though heavily obfuscated, suggests a 'worksheet' theme, aligning with common social engineering lures.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=glaciers+worksheet+pdf
    • https://static.s123-cdn-static.com/uploads/4451033/normal_600993287f8bd.pdf
    • https://cdn.sqhk.co/jojojidatun/gjge9qf/didanamiselobezizenu.pdf
    • https://cdn.sqhk.co/jebumujo/g4WQVgi/falling_ball_color_game.pdf
    • https://cdn.sqhk.co/xogatijixe/rhf48hg/bengali_babu_english_mem_film.pdf
    • https://cdn.sqhk.co/binilafobet/4Khfij9/manudefanazefirotu.pdf
    • https://static.s123-cdn-static.com/uploads/4366014/normal_5febda746ea14.pdf
    • https://cdn.sqhk.co/vomifavafo/4PJWqhZ/58266634360.pdf
    • https://cdn.sqhk.co/pulovafafita/dygjFDQ/58980669913.pdf
    • https://cdn.sqhk.co/jenetuwuda/bsichgS/value_proposition_canvas_example_tesla.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/981fb6ac-928f-4bb5-8622-b0b5228a1ff9/58605074442.pdf
    • https://uploads.strikinglycdn.com/files/3e534cfd-cbbc-4a94-b01c-31b44cdab882/is_girlboss_getting_a_season_2.pdf
    • https://uploads.strikinglycdn.com/files/a6e06171-a04d-422d-95ca-bf6f1fa354d9/70911201035.pdf
    • https://s3.amazonaws.com/jukoxisojow/harga_tv_led_panasonic_viera_50_inch.pdf
    • https://s3.amazonaws.com/wuwabobujasivor/22563320112.pdf
    • https://s3.amazonaws.com/mipizaju/do_roombas_work_well_on_carpet.pdf
    • https://uploads.strikinglycdn.com/files/e8d6989c-436d-4f3f-aba0-4ca5f5ff7bcf/41592413398.pdf
    • https://uploads.strikinglycdn.com/files/0737c74d-a487-4fc4-8cba-0617b3fa26b9/on_writing_a_memoir_of_the_craft_review.pdf
    • https://d4cba69e-f3c5-4a64-9e40-69ba24924691.filesusr.com/ugd/b73feb_e892a69c0c334887988c0b8ba73fd37b.pdf?index=true
    • https://627f215e-41ba-4aa4-9906-5f9f9d117739.filesusr.com/ugd/8ab72e_c9d336ec50124a16b9eb1efa18f11f5d.pdf?index=true
    • https://s3.amazonaws.com/wizedumi/26551211236.pdf
    • https://e22e8d81-f41f-4d51-abb1-39b19d2d32bb.filesusr.com/ugd/96bf9d_72c644ba45b14cbbaa165bc957897323.pdf?index=true
    • https://f9fc249e-2e6a-4908-9eb0-88005465a50d.filesusr.com/ugd/2530ee_9c9370481c834e3cb07fac24a5756a00.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f1b9.bin
3746b049a9a9d310a1cc1c673f75d3e8a7d7fe6e87d8b3fef4b8e883596bf919		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF1B9 5428 bytes
font_01_sfnt_off00010443.bin
c70078d2ee4d97114b4263f92e9a63c61422efcd8c61b8ee155d265865a4492a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10443 10880 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.