Malicious PDF — malware analysis report

Static analysis result for SHA-256 259b4854e4adc1f9…

MALICIOUS

PDF

79.5 KB Created: 2021-03-29 13:21:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0b488df3097144f55db4d3352351c60c SHA-1: c68e8b0729cd6b58c6b4db53ae1da467d30d748c SHA-256: 259b4854e4adc1f9f4ddd42eb0c191cb9a323284e46e2cfed6deaaebd13d93fa
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to 'vilenefex.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to a monograph on alcoholism. No scripts were extracted, but the PDF structure and heuristics indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/award?keyword=monografia+sobre+el+alcoholismo+en+bolivia+pdf
    • https://static.s123-cdn-static.com/uploads/4378393/normal_5fed944187ec3.pdf
    • https://cdn.sqhk.co/gubogezemazo/jj8Oiap/kafinejodulinesenivugek.pdf
    • http://gebuhrenfrei-mein.com/gudobelamurekesl6py.pdf
    • http://levelupguild.com/xinimssspw.pdf
    • http://picsonair.com/13224372044a3790.pdf
    • https://cdn-cms.f-static.net/uploads/4492259/normal_603778bb335ab.pdf
    • https://cdn.sqhk.co/dowivita/ejcbgcw/extraccion_de_capsaicina.pdf
    • https://cdn-cms.f-static.net/uploads/4484370/normal_602c6fd2cc264.pdf
    • https://static.s123-cdn-static.com/uploads/4368964/normal_60053f6e9339f.pdf
    • https://static.s123-cdn-static.com/uploads/4369496/normal_5fc9f21935b66.pdf
    • http://sqrab.top/thermal_radiation_heat_transfer_howell_solutionlhwio.pdf
    • http://fasumidivojasuj.iblogger.org/elements_of_a_short_story_with_examples.pdf
    • http://silvanozito.online/57932898051sz3k5.pdf
    • https://cdn.sqhk.co/numovasovev/geicrJS/doom_patrol_trailer_soundtrack.pdf
    • https://cdn.sqhk.co/tategupet/BhieEqi/learn_java_for_android_development_online_free.pdf
    • http://dipitazifageb.iblogger.org/97997603844.pdf
    • https://cdn.sqhk.co/risejesob/fTiexQQ/mosugipakifi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://b20aee1f-b1b7-4e4e-be5e-d884e4ece670.filesusr.com/ugd/10e3af_c8d95c9888b0413eab25d26ecec84c46.pdf?index=true
    • https://78636f1b-f2d6-4e4a-b4e1-07eac4c165d1.filesusr.com/ugd/434c97_e483acb9f7644eb3b18a33211b1db61f.pdf?index=true
    • http://puvuwanixos.rf.gd/zojobedopinesarej.pdf
    • https://9305c775-266c-4126-9ef9-90a5cffee957.filesusr.com/ugd/c3f88d_429b0a1db7404281bf6f346024fa75b8.pdf?index=true
    • https://493f174a-a540-412c-bacb-e5b7b26cbfcf.filesusr.com/ugd/95bb70_43a2179c2a3b463aa55ccf2296ea38e6.pdf?index=true
    • https://1ebfeea1-7d02-43b8-8f0a-002c87bc7f75.filesusr.com/ugd/50dcf6_ccf8d51e34264dbfb97c61270b5f3d18.pdf?index=true
    • https://eff7b67d-fef5-45b7-bcd6-ffb1b71d3a14.filesusr.com/ugd/b4c9df_6398ef82d66144f48dacae94a480681a.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f526.bin
3f5e83c65fe3e98e3c9eeaf138c7fbaf8e9e279bb9d40a77ae023f60b897239a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF526 5772 bytes
font_01_sfnt_off000108b5.bin
6044f144ecd094b489a655882ae5a2bd3e0d5dbf6a3fc8699c03802d139fdcb2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x108B5 12272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.