Malicious PDF — malware analysis report

Static analysis result for SHA-256 25eed6a00c4706bd…

MALICIOUS

PDF

103.1 KB Created: 2021-05-22 16:36:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 2d1c5b17dfba4117cf04cb194d2ae791 SHA-1: d549388a024026f91bf89e6956bd3641307ba0ad SHA-256: 25eed6a00c4706bd50aa6961ea314c44ba700030fd73d72830689519d4ec5f7f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains an embedded URL pointing to a suspicious domain, identified as malicious by ClamAV and ML classifiers. The document body, though heavily obfuscated, suggests a lure related to a statistical physics PDF, likely intended to trick users into visiting the malicious URL. No scripts were extracted, but the presence of the malicious URL and the high confidence detection scores indicate a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/strik?utm_term=statistical+physics+f.+mandl+pdf PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4486535/normal_5ff68e6320d03.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413983/normal_604f7a640f40d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4453335/normal_60150edcc2064.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4475209/normal_5ffc5533b5232.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4501963/normal_5fd398a16e28a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4390095/normal_5fdd355d894aa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410214/normal_60627971794b5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4464067/normal_6067a1ccca354.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412591/normal_5fd7ac616b832.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4391001/normal_6005038fc8b7c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485015/normal_600a4e268756e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489975/normal_601d9f5d1e4f8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384836/normal_604f6bf960ff5.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/toguvaju/sonic_nutrition_facts_chart.pdfIn PDF document text
    • https://s3.amazonaws.com/tawovojo/71905569499.pdfIn PDF document text
    • https://s3.amazonaws.com/jixeremipet/66425775398.pdfIn PDF document text
    • https://s3.amazonaws.com/polexebuj/tizosexilukegogox.pdfIn PDF document text
    • https://s3.amazonaws.com/wonumafubij/97483516755.pdfIn PDF document text
    • https://s3.amazonaws.com/ronenitevodo/village_survival_the_eight_season_2.pdfIn PDF document text
    • https://s3.amazonaws.com/tixedujegibex/puziru.pdfIn PDF document text
    • https://s3.amazonaws.com/jukezeluf/15471351856.pdfIn PDF document text
    • https://s3.amazonaws.com/sezewu/final_fantasy_xv_royal_edition_multiplayer.pdfIn PDF document text
    • https://s3.amazonaws.com/tomamujuf/rulaletevu.pdfIn PDF document text
    • https://s3.amazonaws.com/pigolo/marathi_barakhadi_chart_in.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013d16.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13D16 5536 bytes
SHA-256: 4aba11bdd15fe902806d0b5bc6bec601aa7268de9e9740988e665bc0ba869872
font_01_sfnt_off00014fcf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14FCF 13420 bytes
SHA-256: f9b31e0cf6c9bc6af3fdf917facb52b7b980427ea7d862568044dec6ce129c22
font_02_sfnt_off00017911.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17911 16232 bytes
SHA-256: 561f812873edee893358484a1d0b15725aafdee0cf7f20b6ea7f7f5924cce937

Open this report in the interactive analyzer, or submit your own file for analysis.