Malicious PDF — malware analysis report

Static analysis result for SHA-256 226b2a4569a99038…

MALICIOUS

PDF

74.9 KB Created: 2021-03-19 22:16:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d3940db4fa3dfaeb16c93a14124f7b57 SHA-1: a4fbe81d0c20147bb3dc54662828be9e4ab3ee44 SHA-256: 226b2a4569a990380c60b925a9a4a26d8bd2a5bc5b62d0cb0f2d52f2b2934c0e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, appears to be a lure related to a comic PDF, further supporting a phishing attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=halo+fall+of+reach+comic+pdf
    • http://gikadoketu.iblogger.org/bisection_method_theory.pdf
    • https://cdn-cms.f-static.net/uploads/4425921/normal_6037ca490a031.pdf
    • https://cdn-cms.f-static.net/uploads/4418385/normal_604340231e23d.pdf
    • https://cdn-cms.f-static.net/uploads/4480594/normal_60391914eec79.pdf
    • http://kitafoged.medianewsonline.com/25747560120.pdf
    • https://cdn-cms.f-static.net/uploads/4375891/normal_604415d4ddc5b.pdf
    • https://static.s123-cdn-static.com/uploads/4467318/normal_5fe1cd6cc2b6f.pdf
    • https://cdn-cms.f-static.net/uploads/4407997/normal_603942a95a05d.pdf
    • http://komozazene.getenjoyment.net/43564895455.pdf
    • https://cdn-cms.f-static.net/uploads/4380869/normal_602259ffa33ea.pdf
    • https://cdn-cms.f-static.net/uploads/4500208/normal_6040eace42141.pdf
    • https://cdn-cms.f-static.net/uploads/4417809/normal_6034433b030f6.pdf
    • http://zarewubizeno.mywebcommunity.org/what_factors_affect_nerve_conduction_velocity.pdf
    • https://static.s123-cdn-static.com/uploads/4496824/normal_5fc8ced459529.pdf
    • http://tadurarawi.mypressonline.com/tuzumegudamat.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/7f9591de-6615-44a1-b46b-df102519a945/how_many_calories_are_in_a_taco_bell_crunchwrap.pdf
    • http://xabigobagexuk.epizy.com/22339955619.pdf
    • https://uploads.strikinglycdn.com/files/ca8d354a-ae04-49da-a773-47a9721ba0ba/13525448573.pdf
    • https://uploads.strikinglycdn.com/files/692c0d55-b1fd-4161-80bd-e7167a0287b2/562160561.pdf
    • https://uploads.strikinglycdn.com/files/63f2396c-d679-41aa-9da1-fb68334281bb/visopile.pdf
    • http://vomigok.rf.gd/sovegodavo.pdf
    • https://uploads.strikinglycdn.com/files/0e3aae72-3e37-4896-b0e2-93bd1cd7caa8/sims_4_august_patch_broken_mods.pdf
    • http://zogoxuf.atwebpages.com/what_is_catching_fire_book_about.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e6e1.bin
b865d93a3b41cb03c4b3e4e5643ba8aa9cbb40b043ae0607f3fe902727cc78db		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE6E1 5176 bytes
font_01_sfnt_off0000f854.bin
87961d8b67e09b6d586b61b90bab1849c148b887f52950ac3e7dd0772f3ea2a9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF854 11168 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.