Malicious PDF — malware analysis report

Static analysis result for SHA-256 2488e35bdb314793…

MALICIOUS

PDF

77.7 KB Created: 2021-05-16 07:47:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 51c3d1be349940a6308531a94b239809 SHA-1: c33eb564069d750e38a8cf671be0f086373eb960 SHA-256: 2488e35bdb3147932bef29758bcff8e53bbfd252ed86f71e97b037c656925d46
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, which is likely used to deliver a malicious payload or conduct phishing. The document body, though partially corrupted, suggests a lure related to a 'Black spider xt helicopter user manual'. No scripts were extracted, but the presence of external URIs and the overall detection profile strongly suggest a phishing or malware distribution attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=black+spider+xt+helicopter+user+manual PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4377410/normal_6023c86245e3b.pdfIn PDF document text
    • http://hotsales-com.xyz/58405322393h2b1h.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451018/normal_5fe69b549e0cf.pdfIn PDF document text
    • http://mixutadumekaje.mypressonline.com/cgp_an_inspector_calls_revision_guide.pdfIn PDF document text
    • http://app-3null.com/fsrm_folder_size_reporta89gt.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451225/normal_602d76dbe13d0.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4415537/normal_5fc98fa89a323.pdfIn PDF document text
    • http://vegofejolafud.mygamesonline.org/65516249922.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/kovibu/45313214959.pdfIn PDF document text
    • https://s3.amazonaws.com/rizijubovapuk/zisopude.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fc057d44-7ba8-4c54-82be-5af4c15e1c1b/is_there_a_mortal_instruments_city_of_ashes_movie.pdfIn PDF document text
    • https://s3.amazonaws.com/juzowilipi/crash_bandicoot_gba_rom.pdfIn PDF document text
    • https://s3.amazonaws.com/dowadotiju/70536130992.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cd3c05cf-66f0-4c0d-898b-069d4e83f43d/millers_falls_miter_box_history.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/266d25bc-b74a-4b08-a888-b44fc6c25322/la_ciudad_de_las_bestias_analisis_de_los_personajes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b31491b6-5e13-4ab7-ad93-1b703a78ef35/asus_rog_maximus_vii_hero_manual.pdfIn PDF document text
    • http://wivaxodi.onlinewebshop.net/the_cellist_of_sarajevo_character_analysis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/452ec384-12f9-4f60-93a3-1046d5892b6d/scientific_method_practice_answer_key_8th_grade.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef11.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF11 5492 bytes
SHA-256: fb19c2f93e86da9eddca32c75195068d506f6332106a4163b41b8d764f4e8a36
font_01_sfnt_off0001019a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1019A 11380 bytes
SHA-256: 3ca48bfabd3dc373390cf108485ae36ac8d9ffee5118d706150d113fce441b4a

Open this report in the interactive analyzer, or submit your own file for analysis.