Malicious PDF — malware analysis report

Static analysis result for SHA-256 1b69f4c403629b8a…

MALICIOUS

PDF

110.8 KB Created: 2021-03-22 20:17:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e1e9c5310394d5c9d6e235fd630d4fde SHA-1: 6d0937fbabedbde10b46728f9ce4c0dd430ec83e SHA-256: 1b69f4c403629b8a6d6a295ca04a342ce0e0f6e77086e44f585c7d067dd7050a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, and contains an embedded URI pointing to a suspicious domain. The PDF structure also shows signs of manipulation, with duplicate object bodies. The primary attack vector appears to be directing users to a phishing URL, likely to harvest credentials or deliver further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/wix?keyword=how+long+is+a+history+ian+mckellen+on+stage
    • https://kiwiwutirove.weebly.com/uploads/1/3/4/7/134707888/ruwubipetezudu.pdf
    • https://static.s123-cdn-static.com/uploads/4450243/normal_5ffd837b9f617.pdf
    • http://mugurapit.sportsontheweb.net/antioxidantes_versus_radicales_libres.pdf
    • https://ragojozuzaz.weebly.com/uploads/1/3/4/6/134668900/299d1b7a87.pdf
    • https://cdn-cms.f-static.net/uploads/4380084/normal_602f5c055fb3e.pdf
    • http://xujaxul.mywebcommunity.org/all_train_station_code.pdf
    • https://static.s123-cdn-static.com/uploads/4365627/normal_5fcd8151c5fa9.pdf
    • https://nojilino.weebly.com/uploads/1/3/1/4/131407263/lijusasonug-dalur-runifido-wiwalofize.pdf
    • http://sujabupinoda.scienceontheweb.net/veroluwufidofe.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://49b7c339-fea6-4bb3-bf7b-ca47af5263df.filesusr.com/ugd/6ca12d_6da96ef31bc441c192188223aa43ace4.pdf?index=true
    • http://sulorowanutabu.atwebpages.com/virgil_abloh_figures_of_speech.pdf
    • https://uploads.strikinglycdn.com/files/91ae7e34-f3b8-431c-8ab1-ac08f34d45a1/kabobikom.pdf
    • https://uploads.strikinglycdn.com/files/d47bbf3f-ff67-4b1b-9689-ea624b948533/ranodukuladus.pdf
    • http://gubadif.myartsonline.com/nikon_d40_lens_price_in_india.pdf
    • http://firiwigisu.atwebpages.com/when_were_prisons_invented_in_america.pdf
    • https://2a4c341d-9af7-4f89-b48a-1b926ad6ced7.filesusr.com/ugd/dd6616_ee51745417cb4363a2fb3ab770313ad1.pdf?index=true
    • https://3e1af3dc-cf37-4f58-935d-0a6065bc5ce9.filesusr.com/ugd/3ca236_0eb638e0065a4da983ea21b5ffab49f4.pdf?index=true
    • http://wenares.myartsonline.com/arduino_starter_kit_manual.pdf
    • https://uploads.strikinglycdn.com/files/be00605a-0fa8-4094-8869-616780a37b1f/miwogukuwajazufat.pdf
    • http://sewujajapivix.onlinewebshop.net/72996703452.pdf
    • https://uploads.strikinglycdn.com/files/b5f8ef5e-3cbf-440c-b238-deef091ae788/xemeb.pdf
    • https://uploads.strikinglycdn.com/files/d16ce8f2-93d0-447a-abf3-c65b61ff33a6/watozolasoluzix.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000166d6.bin
15afd5c31776dd5a96c6652bae7d64bb0c91cf7ad1feb48ec7657ccf8bb9cb74		 pdf-font-stream PDF embedded font (sfnt) at offset 0x166D6 5220 bytes
font_01_sfnt_off00017878.bin
0410b57e19175fd480cbd36caa954dcc3bd33cc4cb2138c720e1ff50a4a1a7e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17878 11352 bytes
font_02_sfnt_off00019ee9.bin
ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19EE9 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.