Malicious PDF — malware analysis report

Static analysis result for SHA-256 21e7bdb917974b94…

MALICIOUS

PDF

92.5 KB Created: 2021-03-28 11:47:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 723201a9ffab6d35764f5fd8b18f29e3 SHA-1: 7228f531681506a138bf44da404cd32adf63bd18 SHA-256: 21e7bdb917974b946cab8e091bb766bf2cb61d6438544b5bcd14d1b60d40c4b0
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, appears to be a lure related to learning Arabic, aiming to trick users into visiting the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/award?keyword=apprendre+a+lire+et+ecrire+l+arabe+pdf
    • http://pexukakadom.22web.org/wiresuganosexe.pdf
    • http://cucoupon.info/nerewomevofijqjet4.pdf
    • http://pc-remont.website/wavaworejefotujugimuwormc1w.pdf
    • https://cdn-cms.f-static.net/uploads/4454968/normal_601ffded14aa6.pdf
    • https://static.s123-cdn-static.com/uploads/4374532/normal_600273a9ef08a.pdf
    • http://milafikolume.iblogger.org/messaging_app_for_ios_and_android.pdf
    • http://sodaapp.club/sesakifodobekxsulw.pdf
    • https://static.s123-cdn-static.com/uploads/4487663/normal_60071f18925e4.pdf
    • http://burrrhey.tech/church_management_system_documentation0z01q.pdf
    • https://cdn-cms.f-static.net/uploads/4458856/normal_6021a772d321e.pdf
    • https://cdn-cms.f-static.net/uploads/4454820/normal_6027376979e3a.pdf
    • http://avlto.best/xerulutuxojovumeduscyyak.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://7162f0c1-3bb2-4775-9ad2-1e34613fb889.filesusr.com/ugd/595093_603ff39589f54d078068ffc3c74ac857.pdf?index=true
    • https://064d663d-f6b2-44cf-a6ad-083da5f315e5.filesusr.com/ugd/77eba6_db29bcc25f024f039781cda761d6e67b.pdf?index=true
    • http://wugezirux.epizy.com/microsoft_timesheet_calculator_excel.pdf
    • http://xepuzuxomof.rf.gd/bibliography_apa_format.pdf
    • http://wadatenut.rf.gd/genius_pen_mouse_user_guide.pdf
    • https://0fc0baf9-b884-4fcd-968e-f93c0f938930.filesusr.com/ugd/68ec51_a65ca1d491af4f208c7b1ee75c66930c.pdf?index=true
    • http://vaxesopubowutuf.rf.gd/arukenimon_human_form.pdf
    • https://27f1a270-5048-4778-87f0-574dfe85248a.filesusr.com/ugd/b7306e_4c0ddeb321a44233903d033a1bd4c255.pdf?index=true
    • https://98e80eac-0673-4bf9-a3de-4132461903b3.filesusr.com/ugd/1acd69_5341881f741344d9a199f5834aad6bdb.pdf?index=true
    • https://5e54824a-8208-41b0-8aeb-7c017e8cfb46.filesusr.com/ugd/f64db8_3985a06f0101458caaea9e517ddf9fcf.pdf?index=true
    • https://8dac4d01-2cd1-45d2-8b5f-6005f802adc9.filesusr.com/ugd/1f96ce_f4d259bb2ad74d5faef3598015ba8522.pdf?index=true
    • http://davafegi.epizy.com/67418188606.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00014421.bin
1eb7669844198b448f86e85157fffe9b4ea52bee54ec2e051086405a8e3c36c8		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x14421 18816 bytes
font_00_sfnt_off000109e9.bin
cbd7f1e5ca00134ea3cde4dc01278b8d5b887944c62681ef67c09fbd8a23a475		 pdf-font-stream PDF embedded font (sfnt) at offset 0x109E9 5100 bytes
font_01_sfnt_off00011b4d.bin
e02647e55a01bee88774b1467c89903952c42682e1a1cda4a497e80ca0a35bb6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11B4D 12944 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.