Malicious PDF — malware analysis report

Static analysis result for SHA-256 1d5b5d9cbcba55ba…

MALICIOUS

PDF

88.4 KB Created: 2021-03-20 23:38:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dc7d2268c313574f67d2790f4552fa2e SHA-1: 28ab4ef2bfaee70fef4bc6143cffb548381b9915 SHA-256: 1d5b5d9cbcba55ba59bd8c802558c1eb07ad3fb5fa4ea549bd159e5c5da2696b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. The embedded URL `https://dafemum.ru/aws?utm_term=the+veil+norfolk+parking` suggests a lure to a malicious website. Although no scripts were explicitly extracted, the PDF structure and heuristic firings point towards a malicious document designed to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/aws?utm_term=the+veil+norfolk+parking
    • http://kernig.online/4526136905164ctm.pdf
    • http://servempieza.site/honeywell_th6110d1021_thermostat7stp3.pdf
    • http://tefuvawilutir.mypressonline.com/3539589105.pdf
    • http://helpcreditscore.info/which_country_has_highest_per_capita_income_in_201984u8i.pdf
    • http://gagefiwirimat.medianewsonline.com/kusiwilimarumupi.pdf
    • http://mailedflkf.site/4229280632521g51.pdf
    • http://buybritishcat.com/minuet_in_g_beethoven_violin_sheet_musicpp1mz.pdf
    • http://widonatozeg.mypressonline.com/85295881848.pdf
    • http://probkin34.xyz/xerizefivan6h5rm.pdf
    • http://playmarket-online.com/what_to_avoid_on_the_dash_dietoo9up.pdf
    • http://bigtittybella.com/have_you_ever_song_worksheetc1z48.pdf
    • http://lumasilove.iblogger.org/49683205359.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/sabobenuwe/2431897173.pdf
    • https://s3.amazonaws.com/kewuxejikiwe/el_coronel_no_tiene_quien_le_escriba_resumen.pdf
    • http://wewamamewiler.atwebpages.com/lisogodop.pdf
    • https://s3.amazonaws.com/jawusawar/wowikogesojapipajezazi.pdf
    • https://uploads.strikinglycdn.com/files/fef42fb5-8b8d-4109-b7e8-caf9c45de9d2/how_to_remove_ge_profile_microwave.pdf
    • http://miwetiguv.epizy.com/59921515697.pdf
    • http://pubometev.rf.gd/brand_collaboration_proposal_template.pdf
    • https://uploads.strikinglycdn.com/files/6456dbe3-c98d-4a85-932b-a76e410c34c6/notekexotazite.pdf
    • http://wafalox.rf.gd/domain_driven_design_quickly.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f9ff.bin
d44f7d36526d0f9804383d56816dc0f6e362deec9c6dd8a807477a0f73abd4d7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9FF 5056 bytes
font_01_sfnt_off00010b32.bin
886c37836f5724f1430c3bc4b33a36bb18b7bce29473efee535fc21d8c745794		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B32 1968 bytes
font_02_sfnt_off0001147d.bin
dff7748d842a1646c55c9e536d251ad4faa312f01d876a56c2aa6c01057c58de		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1147D 11956 bytes
font_03_sfnt_off00013d64.bin
8647281a3c744fc6d0b53cd0b4129fbf868dc80d788fe83738ada4fefb377b5a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13D64 16040 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.