Malicious PDF — malware analysis report

Static analysis result for SHA-256 250b08ccc7a74836…

MALICIOUS

PDF

76.0 KB Created: 2021-05-04 10:25:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2c7605696461659a85e9436af83574f4 SHA-1: 782626e82f80c4143fc374023355bee63c060dd3 SHA-256: 250b08ccc7a74836af10fae778be1b5be247d3abc76cad964d88faaca469a139
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document detected as malicious by ClamAV and an ML classifier. It contains an embedded URL that leads to a suspicious domain, likely for phishing or malware distribution. The document body is heavily obfuscated, but the presence of the external URI and the overall detection suggest a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=midi+usb+to+bluetooth+adapter
    • https://cdn.sqhk.co/sudizatase/BPijNcc/xamodotit.pdf
    • https://butapakenora.weebly.com/uploads/1/3/1/8/131871909/8966693.pdf
    • https://porepegozid.weebly.com/uploads/1/3/6/0/136050151/voladosixotunodi.pdf
    • https://cdn.sqhk.co/rufosopufu/dghmxih/dinikona.pdf
    • https://static.s123-cdn-static.com/uploads/4455881/normal_5ff96ed278666.pdf
    • https://cdn.sqhk.co/vufebevefo/Hiisiiw/new_york_city_must_visit_places.pdf
    • https://xiruzukigipimog.weebly.com/uploads/1/3/4/8/134865515/zozejule.pdf
    • https://cdn.sqhk.co/buruvalufe/cXBOjck/11853695116.pdf
    • https://cdn.sqhk.co/wawerugile/hrYVAih/sujikevurizawe.pdf
    • https://cdn-cms.f-static.net/uploads/4488137/normal_5fd62ac4d6097.pdf
    • https://cdn-cms.f-static.net/uploads/4383699/normal_60404db19ad52.pdf
    • http://xebobimifu.22web.org/95940469608.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://zatozegajuzu.epizy.com/latest_bollywood_movie_mp4_song_free.pdf
    • https://s3.amazonaws.com/woxewiwupir/moragebuk.pdf
    • https://s3.amazonaws.com/laginekux/opportunity_analysis_template.pdf
    • https://cb0920a4-0dfc-4587-8161-bd3bf883b043.filesusr.com/ugd/df391a_735de9f8b6e54df2b950dc9c7e84f930.pdf?index=true
    • http://robexede.rf.gd/concept_of_human_development.pdf
    • https://s3.amazonaws.com/salosibejodod/42552911907.pdf
    • https://6d251753-49d0-4f5b-a278-10ed1cacc9d0.filesusr.com/ugd/5c139a_49bf5e7f41cc4184a137314f1ced7da0.pdf?index=true
    • http://lezegunotoxom.rf.gd/start_tor_browser_32_bit.pdf
    • https://s3.amazonaws.com/zikeko/samsung_rf323tedbsr_aa_bottom_ice_maker.pdf
    • https://71b4061d-0fbe-47a8-a671-08758978b022.filesusr.com/ugd/0216f2_a6ebeecf6ec24f79831ba8c128fd0bc4.pdf?index=true
    • https://fe92b815-f0fe-4223-924b-659339f44b90.filesusr.com/ugd/8f64fc_2f1c6403a9444414a04543a95259a7fb.pdf?index=true
    • https://s3.amazonaws.com/bisiku/cuisinart_ice-30_instructions.pdf
    • https://63c5840e-267c-49ed-94d3-fc9f9d8b9c0b.filesusr.com/ugd/8c5bc8_4dfc92ab76bf42acbf80083adc3f2b7a.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec89.bin
cc9426a743fa9457f98be184d6842142c9b50476507fc5c72033b06b94f5fa53		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC89 5192 bytes
font_01_sfnt_off0000fe29.bin
e4b38d69a97898d703f4b8012e948e983e079a621207552aaea0c80f33735b25		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE29 10776 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.