Malicious PDF — malware analysis report

Static analysis result for SHA-256 27932caaa3a1fb66…

MALICIOUS

PDF

81.7 KB Created: 2021-03-06 22:43:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bd1a41fe8399fffec8b4b64d5e13a49d SHA-1: d4fc9751a5cb28a80dfa17ba182b027ac6950673 SHA-256: 27932caaa3a1fb665178eacc0bb8cd8985d15986e2d9626c5dd284e9ce2fb6bb
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'dafemum.ru', which likely serves as a lure for the user to visit a malicious site. The document body, though heavily obfuscated, contains text related to guitar chords, suggesting a social engineering pretext. No scripts were extracted, but the presence of external URIs and the overall detection profile indicate a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/123?utm_term=ever+be+guitar+chords
    • http://lebizifijafaxim.medianewsonline.com/resumen_del_libro_de_once_minutos_de_paulo_coelho.pdf
    • http://greyfruit.space/national_geographic_kids_videos1bzal.pdf
    • https://static.s123-cdn-static.com/uploads/4403947/normal_5fed14e013595.pdf
    • https://static.s123-cdn-static.com/uploads/4413235/normal_5ff68edf9ba93.pdf
    • http://solapp.xyz/lobosetazyh6u.pdf
    • https://static.s123-cdn-static.com/uploads/4460076/normal_5febb070154a5.pdf
    • http://pipvip.ru/the_german_heiress_book_review4v9bo.pdf
    • http://ukrdomonis.xyz/richard_bandler_best_booksta2fv.pdf
    • http://saxobupazes.sportsontheweb.net/28917051320.pdf
    • https://static.s123-cdn-static.com/uploads/4368951/normal_5fdd8c6d48f85.pdf
    • http://vetebozo.mypressonline.com/peliculas_mitologia_griega_dioses_del_olimpo_en_espaol.pdf
    • http://worelimupuvefam.mywebcommunity.org/cannon_landmark_fire_safe_costco.pdf
    • http://dombitarf.ru/senior_android_developer_salary_in_canadakbbbp.pdf
    • http://woziwowariv.sportsontheweb.net/can_you_charge_a_chromebook_with_a_usb_cable.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/757f28c7-c45e-460c-9322-abb08962a482/30675912482.pdf
    • http://tapoloferazuziw.atwebpages.com/doterra_price_per_drop_sheet_2019.pdf
    • http://sivikonalijuto.myartsonline.com/89489555439.pdf
    • https://uploads.strikinglycdn.com/files/c7a87be9-bc36-4dfe-a729-580984271312/gitinop.pdf
    • https://80820154-e864-4b0c-832b-212b24169927.filesusr.com/ugd/c12414_431592b429fe4e99bfdf0a4571c405aa.pdf?index=true
    • https://9eaa565e-fb97-40b4-b096-d6760803f699.filesusr.com/ugd/55e2c6_0b434c671903488fb2bf4a61b0229e12.pdf?index=true
    • https://83d7d1d1-3661-4158-a2cc-78aa4aa39d08.filesusr.com/ugd/163759_cbd53bef42c2491caf25492d85f924a4.pdf?index=true
    • https://uploads.strikinglycdn.com/files/0c871674-0e10-49b8-b3c9-6da617154527/renudalegirakaki.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000102b3.bin
4ed43e2de5a010ffa6ec182a7a6a67d117545c1995c68d3b1102959f2ef7717a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x102B3 5324 bytes
font_01_sfnt_off000114d2.bin
b21072bc5e6311174c281fec064ab80cc0b7874dc0d58d5a62e55d1d1c916ada		 pdf-font-stream PDF embedded font (sfnt) at offset 0x114D2 10644 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.