Malicious PDF — malware analysis report

Static analysis result for SHA-256 2903b0dbca9ac9ac…

MALICIOUS

PDF

83.2 KB Created: 2021-04-06 12:35:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c0d96e7f832d544bea760ec3da85c848 SHA-1: 5283635aae6b248e5f28cadad37fc21c563f37e7 SHA-256: 2903b0dbca9ac9acbe43d5eb4db7fc0668d95574a473cab6960a3ce21ffc363d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a malicious domain, disguised as a guide for an Excel task. ClamAV and ML classifiers strongly indicate maliciousness, specifically flagging it as a phishing trojan. The presence of external URIs and embedded URLs suggests an attempt to redirect the user to a compromised or malicious site, likely for further exploitation or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/123?utm_term=how+to+put+footer+in+excel+sheet
    • http://13millions-warzone.store/6717776106hpbig.pdf
    • https://cdn.sqhk.co/pininipata/Xigjhih/72313834095.pdf
    • https://cdn.sqhk.co/wuladupuzo/gbaggjf/savumeriwikokexulekusub.pdf
    • http://biotringel.shop/vedujex2axj.pdf
    • https://cdn.sqhk.co/kuburarimoku/fhc1faS/free_bodybuilder_pics.pdf
    • http://gakmancreatures.ru/reported_speech_imperative_sentences_exercises_with_answersgih4p.pdf
    • http://fastgetme.online/dd_best_3rd_level_wizard_spells2yyru.pdf
    • http://sifuzifixezija.medianewsonline.com/sexuality_in_african_culture.pdf
    • http://wosedumuf.mywebcommunity.org/53544016327.pdf
    • https://cdn.sqhk.co/xexerekija/ggiedEF/7977418653.pdf
    • https://cdn.sqhk.co/kopilixa/ie1sEMl/98348691974.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/xajowu/glencoe_7th_grade_math_workbook_answers.pdf
    • https://2ed821ec-8078-4e74-b11b-c5cec6a88262.filesusr.com/ugd/65e777_258e475043114151a93d49ebe3a6dc04.pdf?index=true
    • https://uploads.strikinglycdn.com/files/cdf4d9f2-dd8a-4cc9-b892-f7c328f46f3c/dixidopusexerotisujixupof.pdf
    • https://f6142301-0c02-44dd-b2c5-62cf9b3cd0dc.filesusr.com/ugd/ebfdba_307ebe7f20b4490e97bf26272e2bc7af.pdf?index=true
    • https://s3.amazonaws.com/gelawiweza/fegejesirokasalagawewe.pdf
    • https://s3.amazonaws.com/meludav/velida.pdf
    • https://uploads.strikinglycdn.com/files/ec7ddac3-fd26-4107-8afe-28ebba4d58e7/calories_taco_bell_crunchy_beef_taco_supreme.pdf
    • https://s3.amazonaws.com/fofeguj/9725532072.pdf
    • http://bigapenegig.atwebpages.com/31929407332.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4b9.bin
139208087359f9907ceece815ab6183bb4f74380d85e064b9db78d340b64d87c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4B9 5012 bytes
font_01_sfnt_off000105db.bin
89fec75cee51b6f71ec443126f43c2b6facd39f9a2bdeba933c0b778a0e14dd4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x105DB 10396 bytes
font_02_sfnt_off000129d5.bin
f6e0f4a25f18a144688c6b7f40519a5efc98c72643b9054f89526e396d9b459d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x129D5 16144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.