Malicious PDF — malware analysis report

Static analysis result for SHA-256 1d1eb06e8e0475f8…

MALICIOUS

PDF

99.5 KB Created: 2021-03-17 04:42:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 49d398f2165f13b8a0df395a067c58b5 SHA-1: 9ff34c21e1d2996898511ef4d161dc17e939db66 SHA-256: 1d1eb06e8e0475f8df73d272e514dc12b5342c7da5b3fa1f7e895137cedb446b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically identified as 'Pdf.Phishing.Trojan'. It contains an embedded URL that appears to be a lure for downloading the malicious PDF, disguised as a free translation of the Quran. The document body is heavily obfuscated and contains metadata indicating it was generated by wkhtmltopdf.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9981

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/award?keyword=al+quran+bangla+translation+pdf+free+download
    • https://static.s123-cdn-static.com/uploads/4374698/normal_5fdd8bc65bc0e.pdf
    • https://cdn.sqhk.co/bojidokagivi/ejhhcIH/harvest_moon_gameboy.pdf
    • https://cdn-cms.f-static.net/uploads/4463298/normal_600dd9a411b7b.pdf
    • https://cdn-cms.f-static.net/uploads/4462056/normal_603c872ddc950.pdf
    • https://cdn-cms.f-static.net/uploads/4462696/normal_601ec562d5820.pdf
    • http://zunuruxeguxifi.mygamesonline.org/migokofexamisujiwafewe.pdf
    • http://gowanenutik.mypressonline.com/40938818194.pdf
    • https://cdn.sqhk.co/vizejagojib/jdNighj/tujodigawofujenelamosavan.pdf
    • http://xijivedijimidip.mygamesonline.org/calendario_escolar_2020_19_mexico.pdf
    • http://fajesamosini.sportsontheweb.net/pisokimolat.pdf
    • http://bomepufibawil.scienceontheweb.net/best_buy_weekly_ad.pdf
    • http://zunuruxeguxifi.mygamesonline.org/adding_tooth_to_partial_denture_code.pdf
    • https://cdn.sqhk.co/kozosorole/ifagfOO/bewajamakitoxenulaw.pdf
    • https://cdn-cms.f-static.net/uploads/4372376/normal_6050a6e2242d4.pdf
    • https://cdn.sqhk.co/benibavagoge/kkgehjb/roblox_ban_hammer_simulator_codes_wiki.pdf
    • https://cdn.sqhk.co/judawube/h06hhhf/tik_tok_video_fleetwood_mac_ocean_spray.pdf
    • https://cdn.sqhk.co/mekibekowufe/cjbXLZm/injustice_gods_among_us_ps4.pdf
    • https://cdn.sqhk.co/xubafofin/jjdripG/bevogapod.pdf
    • https://cdn.sqhk.co/befozaxulot/hYJggsH/squeaky_dog_balloon_toy.pdf
    • http://nupesupo.mypressonline.com/attahiyat_with_urdu_translation.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/b01bde9d-aa85-4b79-93b8-dcea5020ace3/68770117166.pdf
    • https://uploads.strikinglycdn.com/files/46ee230e-d3a1-439c-ab43-7ef968735a91/82980315624.pdf
    • https://uploads.strikinglycdn.com/files/8b5d1c42-0973-445f-b7c3-9158d1895bb0/wadapunoxakojejor.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNU
    • http://www.gnu.org/copyleft/gpl.htmRegular

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off00014e3e.bin
0034f61509f6f46637a49334f34dca6c31ecad12e88683dc2e244197da674172		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x14E3E 27708 bytes
font_00_sfnt_off0000fc5f.bin
2688f6ba147a88ce40b304282c15f3fbd2c5344ae92d74d33ac133a33f58ec57		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC5F 5556 bytes
font_01_sfnt_off00010f51.bin
120e770f2792075053b16f197b95b59d05f3df1d0943fec9bf5e723fbb16d30e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10F51 8712 bytes
font_02_sfnt_off00012afc.bin
4ee1ec3a7337897487f5e9a2de189250dc60acabe606eb16b3ba716f82750675		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12AFC 10288 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.