Malicious PDF — malware analysis report

Static analysis result for SHA-256 29d32b97c398a796…

MALICIOUS

PDF

76.0 KB Created: 2021-03-23 09:41:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4181bb097c61d3812dba79afdc890be9 SHA-1: e540a3b96fb45c58a4866b08f840a9c9321e6cac SHA-256: 29d32b97c398a79600b4e46a690f65e1267245b0c53c009d047270c3b9d060b9
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains an embedded URL pointing to a suspicious domain, identified by multiple heuristics and a machine learning classifier as malicious. The document body, though heavily obfuscated, suggests a lure related to a dictionary PDF. The presence of external URIs and the overall classification strongly indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9620

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/strik?utm_term=the+new+oxford+picture+dictionary+english+spanish+edition+pdf
    • http://todibojoposufu.iblogger.org/my_name_is_red_quotes_with_page_numbers.pdf
    • http://supernefritroller.xyz/grade_9_maths_exam_papers_and_answers8w7gt.pdf
    • http://good-production16.site/axial_scx10_ii_jeep_wrangler_hard_bodylmdbb.pdf
    • http://chuvashovfamily.ru/vekugebotusegazarugirasutz0gw.pdf
    • http://sunesasewi.iblogger.org/66791002542.pdf
    • https://cdn-cms.f-static.net/uploads/4379471/normal_601bb3d268f15.pdf
    • https://static.s123-cdn-static.com/uploads/4491164/normal_5ff796a308cc5.pdf
    • https://cdn-cms.f-static.net/uploads/4392451/normal_60471ffbaa941.pdf
    • https://cdn-cms.f-static.net/uploads/4456984/normal_600e064476cda.pdf
    • http://shtangye.xyz/fivegonaboxodesupilu64l5d.pdf
    • http://lumacy.site/what_is_the_central_idea_of_into_the_wildzta32.pdf
    • http://legrand-spb.ru/duxitilizu54x2r.pdf
    • https://cdn-cms.f-static.net/uploads/4408990/normal_60241ebfd5464.pdf
    • http://kellys.space/making_inferences_worksheets_year_27pq78.pdf
    • https://static.s123-cdn-static.com/uploads/4462974/normal_5ff40f797ccdd.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://gurumuniz.rf.gd/roland_spd_30_power_adapter.pdf
    • https://a84030a7-2e48-4039-807a-383e2b7216cc.filesusr.com/ugd/c5d40f_0233d29c1eb347d699e404d43e28e573.pdf?index=true
    • https://67d298e0-85f4-4ad4-bf36-e1ac857e42fc.filesusr.com/ugd/b6bf5b_1c182b8ff5a2423d9a9ed7dc3e518327.pdf?index=true
    • http://zevijefe.rf.gd/bree_serif_bold_free.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f392.bin
e19a4ca9cd568386a62425528e3a1c983cd2dd4284b8a28b0051515990066be5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF392 5628 bytes
font_01_sfnt_off000106d1.bin
48e3e5743761336498f455fc21fd066c7e561231e79785cd3af16c17e2d130e9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x106D1 11556 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.