Malicious PDF — malware analysis report

Static analysis result for SHA-256 2853c7576d8df8de…

MALICIOUS

PDF

77.3 KB Created: 2021-03-14 06:57:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2a8c58b364e89868f15440431081bf0d SHA-1: 505c7b5a0a6ff2b9f2c76fd0e8ba11351d14dba3 SHA-256: 2853c7576d8df8de0f0ceeb16a2ff683ef11e8f5bdf7b858ffaf523774befafc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing attempt. It contains an embedded URL that, when visited, likely leads to further malicious content or exploits. The document body, though heavily obfuscated, suggests a lure related to legal searches, aiming to trick the user into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/wix?keyword=orange+county+notice+of+commencement+search
    • https://cdn.sqhk.co/motuvitewodi/Ajfu52h/lynx_lake_campground.pdf
    • https://cdn.sqhk.co/gowamojon/UVujagd/dragon_quest_builders_2_dlc_islands.pdf
    • https://cdn-cms.f-static.net/uploads/4410432/normal_5fd316c4e7220.pdf
    • https://cdn.sqhk.co/dejuxafe/8Q2idIK/borderlight_live_edge_lighting_colors_to_contacts.pdf
    • https://cdn.sqhk.co/sinupupuzaxa/gvigtif/ap_world_history_quizlet_chapter_4.pdf
    • http://mofemaruwek.sportsontheweb.net/26696123167.pdf
    • https://cdn-cms.f-static.net/uploads/4374522/normal_6036180d11e9f.pdf
    • https://cdn.sqhk.co/sesakiwewe/hdhh0Ua/zombie_commando_mod_apk_unlimited_money_and_diamond.pdf
    • https://cdn.sqhk.co/duzoxibuf/icickEl/random_name_generator_baby_girl.pdf
    • https://cdn.sqhk.co/rewazexi/BibF0ij/enemy_strike_mod_apk_unlimited_gold.pdf
    • https://cdn.sqhk.co/balaragu/gj9Ohbw/little_boy_haircuts_long_hair.pdf
    • https://static.s123-cdn-static.com/uploads/4447464/normal_5fe03e72db0c4.pdf
    • http://wigageturuv.mywebcommunity.org/jewisuxelokavilekivole.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/96fec4e9-3e7e-4924-8195-a932812e236c/how_to_crack_gta_v.pdf
    • https://uploads.strikinglycdn.com/files/3a28e6f1-bba0-45c0-b54f-34278fac8a60/dopodivazogebokokiwaw.pdf
    • https://s3.amazonaws.com/zidenigad/nutisoxapitigurarepapiva.pdf
    • http://sekuwomexapa.myartsonline.com/howls_moving_castle_book_barnes_and_noble.pdf
    • https://s3.amazonaws.com/pujirageg/arteria_cartida_externa.pdf
    • https://s3.amazonaws.com/xupizewuxere/wuxisonenukenovufezik.pdf
    • https://s3.amazonaws.com/fidefofudi/tizexo.pdf
    • https://s3.amazonaws.com/bupijila/orientdb_vs_arangodb_performance.pdf
    • https://uploads.strikinglycdn.com/files/57d306cc-4054-4ac3-9c1d-e3488d2bf1c5/lobivepevedu.pdf
    • https://uploads.strikinglycdn.com/files/03271bdf-79ca-49f1-b453-3bed6e2eb5de/sunagoru.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eda1.bin
370ca31dde539bc1eb3b56910073cd96fd29110e53a34e91e090cdf851362f52		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEDA1 5392 bytes
font_01_sfnt_off0000ffdb.bin
97dbabbba42189987d9b9daea1f0a989014941ea4db21cac520963404d61d681		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFFDB 11580 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.