Malicious PDF — malware analysis report

Static analysis result for SHA-256 1b8225c23aa4e24e…

MALICIOUS

PDF

464.3 KB Created: 2021-04-04 08:23:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dabeb63eb31fa81e5613a63132274b32 SHA-1: 5db93b10578db04ed374eb33f173ce0e88cc1e0c SHA-256: 1b8225c23aa4e24e96550589b8e963238928e8541f972e29b51ee2dc0c174eda
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was identified as malicious by a machine learning classifier and ClamAV, with the latter detecting it as Pdf.Phishing.Trojan. The PDF contains an embedded URI pointing to 'https://dugedepap.ru/strik?utm_term=complete+divine+3.5', which is likely a phishing lure. The document body is heavily obfuscated and unreadable, but the presence of the malicious URL and the detection signatures strongly indicate a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8789

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/strik?utm_term=complete+divine+3.5
    • http://probmake12.xyz/what_does_a_director_of_sales_operations_doetzgt.pdf
    • http://sidegut.22web.org/49038932046.pdf
    • http://4gusevshop.space/dbx_driverack_pa_manuale_italianocpsyr.pdf
    • http://www19216801.site/93761931376h5c8h.pdf
    • http://kevumoler.22web.org/rizafolowifefelumiposov.pdf
    • http://hayatevesigar.online/heat_and_mass_transfer_book_by_yunus_cengel5gri2.pdf
    • http://silkhfig.bid/how_much_does_a_vendor_license_cost_in_georgia6fyq0.pdf
    • http://spiritstudio.ru/worksheets_for_letter_aa6rg69.pdf
    • http://fresh-ita.fun/virtual_table_tennis_hackjl0am.pdf
    • http://changepass.online/ukulele_strumming_patterns_4_4d4fg6.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/6d041f0f-a9b0-4a6b-a97e-24cf0a12c6b7/what_does_a_brand_communications_manager_do.pdf
    • https://47e4df30-8702-49a4-8bd5-327e1546ff06.filesusr.com/ugd/379272_b491973e111540159f267ecdb47cdde6.pdf?index=true
    • https://s3.amazonaws.com/bifamomove/personal_autobiography_examples.pdf
    • https://s3.amazonaws.com/wolawatin/logo_quiz_game_level_2_answers.pdf
    • https://s3.amazonaws.com/xamapebonijos/animal_coloring_worksheets.pdf
    • https://s3.amazonaws.com/vanatul/ardaas_karan_full_movie_filmyhit.pdf
    • https://uploads.strikinglycdn.com/files/f691ae71-e648-4934-a637-d84086cecb9b/53938272350.pdf
    • http://xunixamobogu.epizy.com/fidid.pdf
    • https://s3.amazonaws.com/pirofopafu/que_es_una_acta_constitutiva.pdf
    • https://f2d828cf-06d9-46ea-85af-d88b0bc20d44.filesusr.com/ugd/501a20_1c4613ec8eef4b4fbaabde469c9a4fbe.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a5301869-b18f-4d88-aa94-2d9612298e34/us_history_timeline_from_1600_to_1800.pdf
    • https://c140f178-ee45-427e-91fe-a3c5f821f67e.filesusr.com/ugd/ebc5f9_de4f1fc9b9544ddd85194ff369ad1576.pdf?index=true
    • https://c145ee04-3c3b-4786-8b94-e0511401b322.filesusr.com/ugd/de65f7_08b5d5109bdf4f83abaee784ae637795.pdf?index=true
    • https://uploads.strikinglycdn.com/files/5a98cd37-a0f6-46c6-a9dd-0be50edd2ca1/zetosavusujazexe.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0006f3ee.bin
c2df9ef12be41da2a1d3ee94fa86757066e740686df87dc27450edc846076ee4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6F3EE 4904 bytes
font_01_sfnt_off000704a0.bin
0e62ee9cd84173638dc83421b614eb2b132981874aa4ba561959a9f21f9fdd38		 pdf-font-stream PDF embedded font (sfnt) at offset 0x704A0 12624 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.