Malicious PDF — malware analysis report

Static analysis result for SHA-256 1e2a2d6fb66bdf11…

MALICIOUS

PDF

204.1 KB Created: 2021-04-23 21:25:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a92b882229b9afe67eed481b5ceb19e0 SHA-1: 67c1214693686fb29d89a5222df74095f036d35a SHA-256: 1e2a2d6fb66bdf11fc4e0f8a2fa17be84a6a1378578fe13a5d7655bf7a30f953
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains an embedded URL that directs users to a suspicious domain, likely to host a malicious payload or phishing page. The document body, though heavily obfuscated, appears to be a lure, possibly disguised as search results or informational content to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9718

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/strik?utm_term=in+confucianism+what+is+the+superior+man+called
    • http://lodomujimujug.mywebcommunity.org/nowepugonom.pdf
    • http://rujitexoxobag.mypressonline.com/divamugekapid.pdf
    • https://cdn.sqhk.co/tarekekog/6ZggBHM/grab_driver_didn_t_pick_me_up.pdf
    • https://niliwuwez.weebly.com/uploads/1/3/4/2/134265541/d06c6983c95338.pdf
    • https://birifaxita.weebly.com/uploads/1/3/4/7/134718336/nuneruxoxomef-jinamoluva.pdf
    • https://cdn.sqhk.co/podidiwi/czijNZs/limitations_of_stokes_law.pdf
    • https://bojurejid.weebly.com/uploads/1/3/4/8/134887271/6120009.pdf
    • https://cdn.sqhk.co/xuwadezab/EideoJG/49553099481.pdf
    • http://soluzixod.66ghz.com/57390965292.pdf
    • http://gagogepatajebe.medianewsonline.com/amazon_cloud_computing_with_java.pdf
    • https://cdn.sqhk.co/suxujaba/fhhgdjf/dude_perfect_airplane_trick_shots_2.pdf
    • http://rezanufeku.mygamesonline.org/edexcel_btec_sport_level_3_book.pdf
    • http://piriveva.scienceontheweb.net/nawaredokogewumowa.pdf
    • https://cdn.sqhk.co/sunomedude/WDJhdlz/33125878282.pdf
    • https://cdn.sqhk.co/fuvivemu/jjkPjeH/jarvis_assistant_android_app_download.pdf
    • https://rutebesutev.weebly.com/uploads/1/3/4/1/134131531/medelovut.pdf
    • https://nemusadepupozug.weebly.com/uploads/1/3/1/4/131453027/mutanogo-xukez-miretidir-ladikul.pdf
    • https://cdn.sqhk.co/jinubodilev/gh6haia/rush_hour_3_full_movie_stream.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://sezusin.rf.gd/george_foreman_outdoor_electric_grill_cooking_times.pdf
    • http://rupiroliwon.epizy.com/21026361837.pdf
    • http://fadifisevak.epizy.com/piano_songs_sheet_music_free.pdf
    • https://438e95ed-c264-4db5-88d3-1a9ca8b91b86.filesusr.com/ugd/733c1f_eeb287e147fd471594ddfb178cdf31a7.pdf?index=true
    • https://ebd73b9a-b255-48a5-b781-2bd84b483b4c.filesusr.com/ugd/956c05_2ec0e4e10f1941cdad15ad02b158832a.pdf?index=true
    • https://d8acad56-eb9a-42d1-a06c-a695c5b02328.filesusr.com/ugd/0ad6c7_4c6e631a6dfa47e9bf8111207828923c.pdf?index=true
    • https://4f6c49ad-35c2-4e1b-a50e-a4ca4816ee30.filesusr.com/ugd/a28dad_342dada9c6e84b5f959e2dd3ed68d5b8.pdf?index=true
    • https://85ed388a-52e0-4e79-9737-9d4b769dda71.filesusr.com/ugd/bb10c5_3031201b32244848a83f6307b5f74890.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002debb.bin
0cf0d5177bdd6b21398a8939b2ea5f3ec11f4de337f8333616e96ecd2d7c00c9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2DEBB 5308 bytes
font_01_sfnt_off0002f0a7.bin
6156f18a1e02334becbd051e08a8e17d5e19eabf6ceeede7bdf960b5b254ff40		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2F0A7 10084 bytes
font_02_sfnt_off0003131b.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3131B 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.