Malicious PDF — malware analysis report

Static analysis result for SHA-256 1b4fe90314b0cc11…

MALICIOUS

PDF

83.0 KB Created: 2021-03-17 16:13:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 138406724039fe7b134672a1499292c2 SHA-1: a8ff2ef401b9f4a44417018d134df39d83830a7e SHA-256: 1b4fe90314b0cc119621bbd4ea1fde2495e9e569606dcdde5d230c2e09b83090
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, appears to be a lure related to Google's organizational culture, intended to trick users into visiting the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=what+is+the+organisational+culture+of+google
    • http://futup.ru/xuvamulagolafakerazpfhvt.pdf
    • http://korixoludofuguk.scienceontheweb.net/carnival_of_venice_trumpet_sheet_music.pdf
    • https://cdn.sqhk.co/mosizuwowux/fVgfwge/96081865318.pdf
    • http://boomua.site/indian_philosophy_books_in_bengali7xm8i.pdf
    • https://cdn.sqhk.co/juvanejejuwo/jjgRAhj/bulujuzerapojibejitu.pdf
    • http://jamonomikusuka.22web.org/18099111627.pdf
    • http://pawezujexas.mywebcommunity.org/how_do_you_sync_directv_remote_with_tv.pdf
    • http://farvestnn.ru/sunbeam_heated_blanket_high_light_blinkingf56fd.pdf
    • http://sodaapp.pro/how_does_the_mistborn_trilogy_end0947s.pdf
    • http://boludibaderujir.22web.org/baloncesto_historia_y_reglas.pdf
    • https://cdn.sqhk.co/genopeno/jbkaFgg/freenet_apk_download_old_version.pdf
    • http://lavkavkusa.store/dilipekuxiket3xhn9.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://zapusov.atwebpages.com/gupometatepari.pdf
    • https://52ed6390-a5c1-4502-9f93-599cf6d98ad1.filesusr.com/ugd/f7fbc8_2e059d7da120473f889c615a9fed3dc9.pdf?index=true
    • http://situwosase.myartsonline.com/ragupiwefadegakozosabi.pdf
    • http://gemovimuwopete.atwebpages.com/vaxadegusovuxogudewasolul.pdf
    • http://lefamuredemupi.epizy.com/christian_hymn_will_you_come_and_follow_me.pdf
    • http://ruruwuvatokatal.onlinewebshop.net/interesting_writing_prompts_for_high_school.pdf
    • http://wawikoduvebakap.onlinewebshop.net/rig_veda_in_bengali.pdf
    • http://besuwodusibix.rf.gd/38388558840.pdf
    • http://woxesizefibugel.atwebpages.com/what_are_the_keywords_for_compare_and_contrast.pdf
    • https://ac263381-fdad-4fda-ae78-6df6d71032d6.filesusr.com/ugd/25c42e_9913d64c6c484812803c18c6c877708c.pdf?index=true
    • https://73f4d879-981c-49fe-abc7-520f36a14a84.filesusr.com/ugd/b77b08_4105702011e449ab99f5b4b5d8fc27f0.pdf?index=true
    • http://xajizufobuvofo.epizy.com/koboridosukubatenebator.pdf
    • https://f8206d31-21c4-4aef-9da9-e4259ded718a.filesusr.com/ugd/c2bdac_3eeb05408eee4b53a7899ff21efa240d.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000105b3.bin
a4dc71eaa13448f7dc7012f9f29f3a70d783c3b935cdf8adbb17e7ec778f305f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x105B3 5156 bytes
font_01_sfnt_off0001174b.bin
e5068996c721b08007c95c49fcd5b056c08910108aba7b71649b81173353b75c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1174B 10932 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.