Malicious PDF — malware analysis report

Static analysis result for SHA-256 251b5c486e0a01d7…

MALICIOUS

PDF

86.0 KB Created: 2021-05-24 03:43:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-16
MD5: 6af2cec648f53db9e9aab09e89b0d0a4 SHA-1: 56b1498b5613813fa51e355e921dcb47eb9a1b13 SHA-256: 251b5c486e0a01d76c32ae1921f7ca5dad8265d1867bc2b860f86f4e229f2c6f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, which is highly indicative of a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly support its malicious nature. The document body, though heavily obfuscated, contains text related to search queries, suggesting a lure to a malicious website.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=is+ark+worth+it+2020+reddit PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4407749/normal_602066835ecd1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4463005/normal_5fd0f1954c7f4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4448548/normal_5ffc85d281b18.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4460233/normal_604cf6bc969b8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4455684/normal_605404859307b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4450037/normal_5fdf9d823c82c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393345/normal_606c34aac938f.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jafujasiwetid/como_instalar_adblock_plus_en_chrome_android.pdfIn PDF document text
    • https://s3.amazonaws.com/jupudizadid/pusirukajewakegedudu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a7afac4b-9020-495b-bb14-e8e433b22aaf/guerra_carlista_valle_inclan.pdfIn PDF document text
    • https://s3.amazonaws.com/sefepugolupalax/41490730596.pdfIn PDF document text
    • https://s3.amazonaws.com/fisulefajow/6843039727.pdfIn PDF document text
    • https://s3.amazonaws.com/pevuwarobuvowa/gugaxajepix.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/80d5af6b-a790-44b4-82f6-2ab36119e177/tawiboxegimobepuvuritir.pdfIn PDF document text
    • https://s3.amazonaws.com/nigimul/cant_sign_into_xbox_360_on_xbox_one.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5f143fbe-c367-4289-9b01-609500b8f6c6/artistic_anatomy_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8c9d33de-328a-46cd-93bc-cd1cce8ecb6f/59480309585.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dc18863c-0601-4d1c-8233-9f47df2e3344/ravidibanosewupuve.pdfIn PDF document text
    • https://s3.amazonaws.com/befafuni/42957884698.pdfIn PDF document text
    • https://s3.amazonaws.com/xetasif/valikanatabonexavipilak.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/496a058a-7251-4d9a-a976-3f7784106f68/84123229216.pdfIn PDF document text
    • https://s3.amazonaws.com/xenavuxa/kolivigev.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0e624717-9fe9-4474-bc96-3b190f5951f0/35564417814.pdfIn PDF document text
    • https://s3.amazonaws.com/patilawasu/femme_fatale_tv_series_episode_guide.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001122c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1122C 5248 bytes
SHA-256: 4190ca75aa687e690a6b5d1d7f51a415f0465c4bef8f5ac67013d3a3c1f97dcd
font_01_sfnt_off00012415.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12415 11344 bytes
SHA-256: 05548b81a7d39d3867882aea9ca84453e7e72f76338cefbd6a48bb9095ae721d

Open this report in the interactive analyzer, or submit your own file for analysis.