Malicious PDF — malware analysis report

Static analysis result for SHA-256 2646b823b2fe8c6f…

MALICIOUS

PDF

81.7 KB Created: 2021-04-05 09:41:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 26dcbfd1c72c4f354aa331c5a5bf699e SHA-1: b64462738f43e944dca9914c16806220befeb2f7 SHA-256: 2646b823b2fe8c6ffa2f3098b4084bdc8273dfa9fc4e2e21d48afd930a31f808
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URI pointing to 'https://xezojetit.ru/wix?keyword=stick+ranger+guide', which is likely the primary lure. The document body is heavily obfuscated, but the presence of the external URI and the malware detection strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=stick+ranger+guide
    • https://cdn-cms.f-static.net/uploads/4445564/normal_606118a73eddb.pdf
    • https://cdn.sqhk.co/solijisivono/EWwtWja/72324857908.pdf
    • https://cdn.sqhk.co/rizitewav/uib9Mjg/exchange_vanilla_gift_card_for_bitcoin.pdf
    • https://static.s123-cdn-static.com/uploads/4403951/normal_5fcb4d14c552a.pdf
    • https://cdn.sqhk.co/donuvoduvedo/f1jfv0Y/7591904666.pdf
    • https://cdn.sqhk.co/wibetaxor/eThjI4j/jump_the_broom_movie_online.pdf
    • https://cdn.sqhk.co/kugefiruxat/dDhiWgh/cube_blast_3d.pdf
    • https://cdn-cms.f-static.net/uploads/4382620/normal_60344ee1f2172.pdf
    • https://static.s123-cdn-static.com/uploads/4370746/normal_5fe18c82ec6c1.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://0face946-3507-4f1d-9804-30df5ac990e4.filesusr.com/ugd/8dfcc1_abf6ee9f8c324c078b011d082960f088.pdf?index=true
    • https://ec679cc6-872a-45a8-b2fd-b1bc8f6ddb77.filesusr.com/ugd/d1d005_f1f168feacdb4874b83894c821f73f29.pdf?index=true
    • https://0e75ab8e-f6a1-4360-bef2-1d94e06fde4e.filesusr.com/ugd/c0518c_4f7299342c1d4a26ac641eabed8db755.pdf?index=true
    • https://s3.amazonaws.com/lazesej/fonidoterata.pdf
    • https://7c9e9c40-2b96-4f88-8065-b5ff5e495659.filesusr.com/ugd/3bfcae_a563cb23971b417796e112cdd3ced7f4.pdf?index=true
    • https://uploads.strikinglycdn.com/files/10671806-8230-45b3-b10d-cd49a12589e8/how_to_graph_velocity_from_position_time_graph.pdf
    • https://s3.amazonaws.com/nitajosasa/wupekuja.pdf
    • https://uploads.strikinglycdn.com/files/18b6ee32-e050-45fc-ac62-56cc7b55349b/why_does_my_side_by_side_refrigerator_is_not_cooling_properly.pdf
    • https://uploads.strikinglycdn.com/files/5d5aa65f-9ae0-47a9-84fe-36e2cf242fe7/norelco_9000_review.pdf
    • https://229c0a76-8cd2-4a6d-ad64-a548a1436bbb.filesusr.com/ugd/f9ed01_6c40fb043439479eb072115ddba73dc4.pdf?index=true
    • https://uploads.strikinglycdn.com/files/569efa7e-72a9-4081-baf1-146bb972d18e/55623017270.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001048d.bin
b21e73ee34f688eef204e113f8f544bfd531bc79b723fd0ab43dd32841cf1b76		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1048D 5064 bytes
font_01_sfnt_off000115db.bin
68ec683993c15fd2d3f7f3f5a861cfbc861dad6aa576f7dffc7e1e997386b861		 pdf-font-stream PDF embedded font (sfnt) at offset 0x115DB 10624 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.