Malicious PDF — malware analysis report

Static analysis result for SHA-256 1f4542415eb2af0c…

MALICIOUS

PDF

77.0 KB Created: 2021-03-21 07:47:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e851b4232746b0be896794ce505f9910 SHA-1: 8ff233d9a78349754a52cadf1af3f43b6227c49e SHA-256: 1f4542415eb2af0c1601adb3ef197fb3cee4c900e85e5fec3bc33a4d65f9aefb
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://dafemum.ru/wix?keyword=closest+self+car+wash+near+me', which is likely used to redirect the user to a malicious site. The document body, though partially corrupted, contains text related to search queries, suggesting a social engineering lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=closest+self+car+wash+near+me
    • http://viwonef.iblogger.org/fanedelewujulukusiwa.pdf
    • http://gapejeg.22web.org/presentation_format_online.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://xarozitapakegur.epizy.com/hoover_max_extract_77_leaking_out_the_back.pdf
    • https://s3.amazonaws.com/dugibabafod/chicken_soup_for_the_soul_story_guidelines.pdf
    • https://s3.amazonaws.com/rekawexuretowo/88420949520.pdf
    • https://uploads.strikinglycdn.com/files/a7a8ae19-c76f-44c6-ac27-f419ac57f40b/2012_dodge_avenger_hesitation_when_accelerating.pdf
    • https://s3.amazonaws.com/zuwimadaneb/69565057185.pdf
    • http://wemiwapava.epizy.com/katurijelozagiwabasabeke.pdf
    • http://pizibajavodup.epizy.com/kamitululawe.pdf
    • https://uploads.strikinglycdn.com/files/b4c63949-7351-4925-9e24-afc372d325fe/levifijufotilemujatiduvu.pdf
    • http://sugekix.rf.gd/what_is_the_plot_of_the_story_peter_pan.pdf
    • https://s3.amazonaws.com/gezetega/the_cross_and_the_switchblade_book_characters.pdf
    • https://s3.amazonaws.com/xoguwavosuje/25231284682.pdf
    • http://vakusidoler.epizy.com/2462114634.pdf
    • https://uploads.strikinglycdn.com/files/99851866-2fad-45ab-9875-e1847ee887b5/kenmore_700_series_electric_dryer_heating_element.pdf
    • https://uploads.strikinglycdn.com/files/4248b064-05eb-498d-9360-2688540a70b0/wefig.pdf
    • https://uploads.strikinglycdn.com/files/c38355b9-c477-47db-a5e7-a8021b21b50f/79821064705.pdf
    • https://s3.amazonaws.com/desenaz/orangutan_meme_template.pdf
    • https://s3.amazonaws.com/tosego/bmv_indiana_drivers_manual_audio.pdf
    • https://uploads.strikinglycdn.com/files/3868f07c-c10b-4849-9dfc-99175d7efca6/how_to_convert_midi_to_sheet_music_musescore.pdf
    • https://s3.amazonaws.com/mubefula/22138818570.pdf
    • https://uploads.strikinglycdn.com/files/bb99f84c-f205-4d2f-8389-326452816dd8/fusapepurafodup.pdf
    • http://mivuwujat.rf.gd/rolodubonudurapobipebe.pdf
    • https://s3.amazonaws.com/muxegeza/diluxivizedajezalaler.pdf
    • https://uploads.strikinglycdn.com/files/6d8ad311-7abd-4b6e-bfdf-d9c21aecf86f/36515302159.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef73.bin
4e826282f78631d455068ae0aad733496359665fba44298017dd040a462a8863		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF73 5120 bytes
font_01_sfnt_off000100c2.bin
67c8973f1c9af11ef842c73f8c626f8e4676047c511aa27d4eddd7a28d8bfc11		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100C2 10608 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.