Malicious PDF — malware analysis report

Static analysis result for SHA-256 23173984870e13d1…

MALICIOUS

PDF

80.1 KB Created: 2021-03-28 05:46:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ad0b343f62c6e717a43266fe2c6ee819 SHA-1: 249159f63e446f0b182bf2aca7a5202f81aad6f2 SHA-256: 23173984870e13d17ddedec47f7a3c8161899b154b8ae66ce5651dd1364242f1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains an embedded URI pointing to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also flagged this PDF with high confidence. The document body, though heavily obfuscated, suggests a lure related to 'Endnote x7 tutorial pdf', likely intended to trick users into clicking the malicious link for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/award?keyword=endnote+x7+tutorial+pdf
    • https://cdn.sqhk.co/xedogigiloli/jcKgh8I/healthy_vegan_snacks_to_buy_uk.pdf
    • http://webpost.pro/culture_of_animal_cells_freshneyuyqj8.pdf
    • https://cdn.sqhk.co/fedelubu/jehaWjd/wavijire.pdf
    • https://cdn.sqhk.co/nudofarus/1iinijw/81301028960.pdf
    • https://static.s123-cdn-static.com/uploads/4462038/normal_5fec58e03d3bd.pdf
    • http://graatorama.space/combine_asynchronous_programming_witaee06.pdf
    • https://cdn.sqhk.co/jumuxabag/A3Hmgj9/95136309006.pdf
    • http://a-trvl.ru/wupiponitisizovqigfv.pdf
    • https://cdn.sqhk.co/konidadelan/jf8giGh/download_block_master_for_minecraft_pe_mod_apk.pdf
    • http://pesale.pro/gardner_howard_1983_frames_of_mind_the_theory_of_multiple_intelligencesaromf.pdf
    • https://cdn-cms.f-static.net/uploads/4366630/normal_60341c99f2aca.pdf
    • https://cdn-cms.f-static.net/uploads/4404287/normal_5fd835b678e06.pdf
    • https://cdn.sqhk.co/ruwonumatag/ijghcyg/vozofowuximex.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/67995c8c-92c5-4ddc-a6ab-98e1b025dc0a/98915719937.pdf
    • http://fededajuna.rf.gd/fusionner_plusieurs_en_un_seul.pdf
    • https://uploads.strikinglycdn.com/files/0cd89b3c-42f0-4a63-8893-65cbb9e69d85/bufatas.pdf
    • https://uploads.strikinglycdn.com/files/65a35c22-48e3-404f-abc4-2048a0931a14/tascam_dr_40x_zoom_h5.pdf
    • http://ridezajumoso.epizy.com/suzovilemunuteko.pdf
    • http://wugemoka.rf.gd/your_brain_at_work.pdf
    • http://varoniwarovez.rf.gd/guided_reading_activity_13-_2_answers.pdf
    • https://uploads.strikinglycdn.com/files/40db7a2d-3c53-4500-8098-89cc120ed46e/tojarovupivujajevax.pdf
    • http://gonoluripep.rf.gd/muxiwigirus.pdf
    • https://uploads.strikinglycdn.com/files/7c6593ac-bfbb-4287-acaf-3605e88a785e/61069605301.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e2a2.bin
ad7cca5eb2065f26e3e0f3fa70501d26826d30ccfb4f7ed006e2914d63f0c54b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE2A2 4964 bytes
font_01_sfnt_off0000f3a1.bin
3525fc88c4e4883b955d52c021a65f9f9d686b8c9cfc8912c601bef82afc9f7d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF3A1 12516 bytes
font_02_sfnt_off00011c00.bin
a95eff378c135b1ab40d10b3cd1da1bafbc07f86005f57898d079c90d712ddbd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11C00 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.