Malicious PDF — malware analysis report

Static analysis result for SHA-256 2625e060956747dc…

MALICIOUS

PDF

70.0 KB Created: 2021-03-27 16:37:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: aa6916ac0cda3aa79e85acc01093621d SHA-1: 2a968ce3e442ca5c801458fbdd1aecb0402da211 SHA-256: 2625e060956747dce339052ed80df28a6b125bea20aae21a680c87d2e5422af7
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'leonvi.ru', which is likely used to redirect the user to a phishing or malware-hosting site. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, suggesting it might be a generated document used as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=samsung+scs-2u01+setup
    • https://cdn-cms.f-static.net/uploads/4416930/normal_604693b30b727.pdf
    • https://tamoniwezetiro.weebly.com/uploads/1/3/5/9/135961995/mubavaxefaxosexokixa.pdf
    • https://cdn-cms.f-static.net/uploads/4492278/normal_60565c8ba6be4.pdf
    • https://nozijuga.weebly.com/uploads/1/3/4/6/134698325/bb0b028ca2e321.pdf
    • https://xanusikufugab.weebly.com/uploads/1/3/4/3/134371049/550da54462f6.pdf
    • https://wobanavemo.weebly.com/uploads/1/3/4/0/134096337/7375527.pdf
    • https://fekugutupufug.weebly.com/uploads/1/3/4/8/134876907/7688462.pdf
    • https://lolijigi.weebly.com/uploads/1/3/4/7/134700793/werivubavemaju.pdf
    • https://lotinusola.weebly.com/uploads/1/3/4/3/134321880/bejolotuduk-fewuvatodig-kezikurab-sivilogufag.pdf
    • https://cdn-cms.f-static.net/uploads/4479445/normal_5fd2644db1b75.pdf
    • https://static.s123-cdn-static.com/uploads/4465277/normal_5fdcd6d4dfe9f.pdf
    • https://cdn-cms.f-static.net/uploads/4426941/normal_601b898a8d14b.pdf
    • https://static.s123-cdn-static.com/uploads/4366020/normal_5ff14b2772fc8.pdf
    • https://static.s123-cdn-static.com/uploads/4381528/normal_5ff85ac4c04c4.pdf
    • https://zekisotirateme.weebly.com/uploads/1/3/4/3/134368555/bepadibatetudu_xijan_gezututalivil.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/0f07c719-331c-41db-a616-f5f5b6576c79/kipubumuweja.pdf
    • https://uploads.strikinglycdn.com/files/332e3d51-eb58-4a23-ae20-a18d251f29d3/26544415813.pdf
    • https://uploads.strikinglycdn.com/files/e45ef905-8d88-42c5-8b6d-df45744d98da/wujugatukekapiv.pdf
    • https://uploads.strikinglycdn.com/files/f3f7e4e0-a6e2-4a9e-9ff1-514ed5dfb1fc/why_is_he_suddenly_quiet.pdf
    • https://uploads.strikinglycdn.com/files/2d1854c7-6117-490a-b017-5a69d5502959/libasafopagafevifo.pdf
    • https://uploads.strikinglycdn.com/files/c0810d40-8663-4b57-a016-fb9262c14405/32076400916.pdf
    • https://uploads.strikinglycdn.com/files/5c164b84-e59f-4b50-abda-53089b2d1c5e/how_to_respond_to_form_interrogatories.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d5a6.bin
bb4639272c66330d173608491eb628e720c557beaaeeb2ea00b054fd57580373		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD5A6 5588 bytes
font_01_sfnt_off0000e8a5.bin
9b4d5a9a5c62024bd750af8dab84aabb911d6ae2a62ab121491bd2ff2286b079		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE8A5 9956 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.