Malicious PDF — malware analysis report

Static analysis result for SHA-256 259d91742f8d34cb…

MALICIOUS

PDF

94.3 KB Created: 2021-04-25 11:43:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5a079dca313e9d836a2089a2a35e1a7a SHA-1: 77f23ecc3bbdb3158608367df463da7149102104 SHA-256: 259d91742f8d34cb35ad3a8767563c702f4768a44f09a4ee845b39675b8fb566
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and a machine learning classifier. It contains an embedded URI pointing to a suspicious domain, which is likely a phishing lure. The document body, though heavily obfuscated, suggests a context related to a 'Life fitness 95x cross trainer manual', indicating a pretext for the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=life+fitness+95x+cross+trainer+manual
    • https://cdn-cms.f-static.net/uploads/4369766/normal_5fdb60bb088d7.pdf
    • https://cdn-cms.f-static.net/uploads/4412902/normal_6022eb31cb737.pdf
    • http://creampiepow.club/how_to_work_treadmill_at_planet_fitnesshrwnu.pdf
    • http://raftgjgr.space/zopamorekaligekuxulisonkeq0h.pdf
    • https://cdn-cms.f-static.net/uploads/4465690/normal_6021028a322f6.pdf
    • https://cdn-cms.f-static.net/uploads/4530910/normal_60464a48d2f0a.pdf
    • https://cdn.sqhk.co/wagomito/JhiFjcB/battleship_cove_fall_river_ma_hours.pdf
    • https://static.s123-cdn-static.com/uploads/4389821/normal_5ff8d6cdc3cba.pdf
    • http://bilet-pdd.site/pafazuretadidokewas1qtz.pdf
    • https://cdn.sqhk.co/norumuwapa/eWSKcDQ/best_hd_wallpapers_for_samsung_a20.pdf
    • http://questotzvezd.space/capsicum_rice_yogambal_sundarpk5oq.pdf
    • https://cdn.sqhk.co/gerezowuves/d6XjeyG/7099353540.pdf
    • https://cdn.sqhk.co/jivomawufem/gBjcLQ7/singing_machine_duet_karaoke_microphone_not_working.pdf
    • http://myyshooop227.site/scratch_2._0_free_for_ubuntu4yrly.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/914ba89e-4bc1-47b6-803e-fc733ed6b56d/one_shot_dnd_5e_italiano.pdf
    • https://uploads.strikinglycdn.com/files/e5e0e412-d441-444e-83bc-f29c8f04de98/child_care_schedule.pdf
    • https://uploads.strikinglycdn.com/files/b8ecf0e4-3876-4dd8-8ed4-fb0fc1cb3599/62102955254.pdf
    • https://uploads.strikinglycdn.com/files/1874d8fc-f8e3-444f-97e8-7542a065e375/sound_blaster_z_pcie_gaming_sound.pdf
    • https://uploads.strikinglycdn.com/files/1130cfb0-a404-463c-8f43-b5c412a21b18/the_girl_scout_law_and_promise_printable.pdf
    • https://uploads.strikinglycdn.com/files/95cee145-8548-4106-b5b6-2059a7911dde/what_is_religion_download.pdf
    • https://uploads.strikinglycdn.com/files/d36a0795-e853-4503-977a-3f631c76faf2/what_is_the_definition_of_a_narrative_situation.pdf
    • https://uploads.strikinglycdn.com/files/d66e6d08-24ac-4fe7-a17f-45dd4b348835/wugofoxafelivexobu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013239.bin
37c1bca8b157c0abee45e2f87e25710f8e9bc41f0702f7feeb09b496d2849145		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13239 5316 bytes
font_01_sfnt_off00014449.bin
97dfcb261fc2cf8e9940e6100c4b9a3d7d19f81fdfd8c6be75d7c111b3118988		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14449 11636 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.