Malicious PDF — malware analysis report

Static analysis result for SHA-256 1b5744b7d5716d15…

MALICIOUS

PDF

75.0 KB Created: 2021-03-12 13:54:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1cb011e16d849bdf9e287e07e51797aa SHA-1: bd11e3d4e2f6e1719634c58c0e5b99d193097746 SHA-256: 1b5744b7d5716d1568fd01feda5853960673f90a17c66b7931f55e0ab0edb52b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URL pointing to 'maypoin.ru', which is likely part of a phishing attempt disguised as an annual report. No scripts were extracted, but the PDF structure and embedded URI heuristic indicate a malicious intent to redirect the user to a potentially harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/123?utm_term=ensogo+limited+annual+report
    • http://copyrightsupporteds.com/915328916687xaqz.pdf
    • http://boketizabujig.scienceontheweb.net/3667437212.pdf
    • http://mibejar.sportsontheweb.net/bear_archery_cruzer_x_rth_compound_bow_package.pdf
    • http://zoomita.space/226777099845si7v.pdf
    • http://portkamesto.site/timex_expedition_field_chronograph_indiglo93t91.pdf
    • http://testersairf.xyz/gtn_750_install_costkstmk.pdf
    • http://wordsidepost.top/kenmore_front_load_washer_error_code_leurdzq.pdf
    • http://bcpzonasegurape2-viabcp.com/valiant_mobile_password_resettbmf0.pdf
    • http://tokexal.medianewsonline.com/jubagepab.pdf
    • http://tehnomaster.net/automatic_mouse_and_keyboard_full_freeta372.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://ligiwekuxote.myartsonline.com/beholding_bee.pdf
    • https://uploads.strikinglycdn.com/files/75fb358a-8718-450c-8611-a58e1601be83/foruxumifazuvubiwumolesem.pdf
    • https://s3.amazonaws.com/panokojol/72583189574.pdf
    • https://uploads.strikinglycdn.com/files/5d66fb5f-6330-4c9f-ac5d-a7e012f0b6dd/35524785171.pdf
    • https://s3.amazonaws.com/jidosatikim/explain_sigmund_freuds_theory_of_personality_development.pdf
    • https://uploads.strikinglycdn.com/files/b94ff706-f6a4-4766-9b33-1a3a51dca827/72098477819.pdf
    • https://uploads.strikinglycdn.com/files/44788fa9-6132-4edd-80de-4ee41976f49f/fusutin.pdf
    • https://uploads.strikinglycdn.com/files/41af9c1d-09f1-4980-867f-835a7d3abac1/xuketadegosami.pdf
    • https://uploads.strikinglycdn.com/files/ad40bebf-f597-4e7f-b308-51359531be7b/digupeterezosojovakazig.pdf
    • https://uploads.strikinglycdn.com/files/30ee9e12-3a32-43e8-9fee-76b342ae9094/richard_dotts_audio_books.pdf
    • http://roporuti.onlinewebshop.net/nijonetosameperijexa.pdf
    • https://s3.amazonaws.com/zemunomipazikez/aashiqui_movie_video_song_pagalworld.pdf
    • https://s3.amazonaws.com/pobixedele/41702832361.pdf
    • https://uploads.strikinglycdn.com/files/e1b8eb1c-b4e4-4cc9-bc55-98d570de503b/best_offline_video_editor_for_android.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e44f.bin
20941e92a7dc4ac2f918e26908886589af7d6f27122ef0c3856669a012195d29		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE44F 5236 bytes
font_01_sfnt_off0000f606.bin
18bc938f7cf7c9b16e77260555c4c944bf21ee8fbaf4a24e55e9218a6d248148		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF606 12004 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.