Malicious PDF — malware analysis report

Static analysis result for SHA-256 1eb576cd3e2ac91b…

MALICIOUS

PDF

71.1 KB Created: 2021-03-18 22:14:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c4ccfd44033d5e2d76232f5326c46927 SHA-1: 64c07df59e5091ea1fe4583ef5e309be4ac614ea SHA-256: 1eb576cd3e2ac91b1e83ad625f4da66d1d5f7bceb1610c1aabb6fd646c7986ee
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, and contains an embedded URI pointing to a suspicious domain. The document body, though heavily obfuscated, suggests a lure related to 'Actual test vol 5 pdf'. The presence of external URIs indicates an attempt to redirect the user to a potentially malicious site for further exploitation or phishing. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/award?keyword=actual+test+vol+5+pdf
    • https://tofavasexivefet.weebly.com/uploads/1/3/4/5/134578877/8e9afb3dec337e.pdf
    • https://cdn-cms.f-static.net/uploads/4409396/normal_5fe6f8dbcfdce.pdf
    • https://mokefogo.weebly.com/uploads/1/3/6/0/136086775/durawinatigi.pdf
    • http://gapagal.mywebcommunity.org/social_anxiety_disorder_assessment.pdf
    • http://lezigovedavide.getenjoyment.net/critical_thinking_skills_meaning.pdf
    • https://cdn-cms.f-static.net/uploads/4404500/normal_600c41be1397b.pdf
    • https://vaxatimiroxak.weebly.com/uploads/1/3/4/6/134617636/mawumumaw_ranozu_pebenazot_bekimu.pdf
    • http://tarigutese.mygamesonline.org/centrifugal_fan_calculation.pdf
    • http://gajelifuluxapov.mywebcommunity.org/beluwinufiwaxivepo.pdf
    • https://verigidiloje.weebly.com/uploads/1/3/0/8/130874422/viserojumowutow.pdf
    • http://tuwukadinem.mygamesonline.org/the_mortal_instruments_city_of_ashes_movie_online.pdf
    • https://cdn-cms.f-static.net/uploads/4445337/normal_5fd65bd769b50.pdf
    • https://nizikalod.weebly.com/uploads/1/3/4/6/134605229/5976974.pdf
    • https://cdn-cms.f-static.net/uploads/4479470/normal_5fdb759bb12ce.pdf
    • https://vamarimorojikav.weebly.com/uploads/1/3/4/6/134640123/pomitekimozu.pdf
    • https://cdn-cms.f-static.net/uploads/4393889/normal_602bfa90c0ad0.pdf
    • https://muvekova.weebly.com/uploads/1/3/5/3/135394778/f2a643b67725.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/8e363d39-ac26-4855-8052-fc0d06d9a41c/what_size_wiper_blades_do_i_need_for_a_ford_focus.pdf
    • https://uploads.strikinglycdn.com/files/9df3237c-a0d5-4346-b34c-9d44b31c1fe5/measuring_and_drawing_angles_worksheet_year_6.pdf
    • http://vozovowu.rf.gd/55612750486.pdf
    • https://uploads.strikinglycdn.com/files/78bf2d91-b007-4130-8d70-e6ede8c588a9/losugulagajoxux.pdf
    • https://uploads.strikinglycdn.com/files/ca390f94-b391-428e-8372-2b4d8e301130/onkyo_ht-s3700_price_in_india.pdf
    • https://uploads.strikinglycdn.com/files/f7079ca9-4456-45e7-aea9-8ab2d76a51f4/zademiwonidafalixepibi.pdf
    • http://nadadeze.epizy.com/jaxajolazevizugifotef.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d7be.bin
f2ba8cce491b6acc0bddf1c8972685224a333513eb9d06c2c5c033b5f4497f59		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD7BE 5224 bytes
font_01_sfnt_off0000e9aa.bin
8280bd76d380be479c072be9c1b605641a6a9cd0f856613c1f383fe5a62b0c08		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9AA 10492 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.