Malicious PDF — malware analysis report

Static analysis result for SHA-256 2c4d79e28bb3e8fe…

MALICIOUS

PDF

83.8 KB Created: 2021-06-10 19:33:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d9ae67d463ed0a7e8de17cdebd0b5e7b SHA-1: e129f36debe60b942812ab406cf90c438292f319 SHA-256: 2c4d79e28bb3e8fe3162d7811336c434e75ae32d4ef24fe10f4b517c04ff8a72
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that, when clicked, redirects to a suspicious domain. The document body, though heavily obfuscated, contains text that appears to be a lure for downloading video content. The ML classifier and ClamAV detection strongly indicate malicious intent, likely phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://laborke.ru/pbw?utm_term=motu+patlu+cartoon+download+video+mp4
    • https://cdn-cms.f-static.net/uploads/4393034/normal_604423fc6d091.pdf
    • https://cdn-cms.f-static.net/uploads/4449992/normal_60595f927d6fe.pdf
    • https://cdn-cms.f-static.net/uploads/4447888/normal_600dbf27ed584.pdf
    • https://cdn-cms.f-static.net/uploads/4452835/normal_606e68c2d3349.pdf
    • https://cdn-cms.f-static.net/uploads/4412164/normal_603421bb7eabe.pdf
    • https://cdn-cms.f-static.net/uploads/4459328/normal_60bade560d7f1.pdf
    • https://cdn-cms.f-static.net/uploads/4465249/normal_60310a8e33830.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/fd5bf884-c735-4a15-829a-e9eef4837a96/76331863571.pdf
    • https://uploads.strikinglycdn.com/files/dc4ca678-3461-40bb-9685-bf3a83f558a4/65_district_of_bangladesh.pdf
    • https://uploads.strikinglycdn.com/files/a6a67c62-b6c9-45ca-b445-6ca0768e1305/gubetekexijalozofuxuki.pdf
    • http://nolumemonip.pbworks.com/f/how_to_read_trumpet_sheet_music_for_beginners.pdf
    • https://uploads.strikinglycdn.com/files/c34bddad-41f6-47c5-b316-a30a55ebd1a3/bobonusizepefoborupedos.pdf
    • http://kusarolox.pbworks.com/w/file/fetch/144514116/add_yahoo_to_outlook.pdf
    • http://wigonewakil.pbworks.com/w/file/fetch/144770643/how_do_you_calculate_total_man_days.pdf
    • https://uploads.strikinglycdn.com/files/2309df48-e8ff-4863-95b1-fbe95323cd3d/how_do_i_update_my_vizio_tv_software.pdf
    • https://uploads.strikinglycdn.com/files/c6fe6068-4869-40f9-bb5d-9367f25506e1/la_odisea_resumen_canto_11.pdf
    • http://pikalunik.pbworks.com/f/can_you_save_videos_from_onlyfans_iphone.pdf
    • https://uploads.strikinglycdn.com/files/885e150a-8c1b-4bd9-8e0a-2adb15b0140d/annabel_lee_summary_sparknotes.pdf
    • http://dadilotofexi.pbworks.com/w/file/fetch/144957537/rugopawopupazanofegokew.pdf
    • https://uploads.strikinglycdn.com/files/dc3cd317-59ed-4598-84ca-a37a929d1d08/what_does_a_203k_loan_cover.pdf
    • https://uploads.strikinglycdn.com/files/46677e11-c6d4-43e8-afce-197a6fac1ce4/jolazivi.pdf
    • https://uploads.strikinglycdn.com/files/91354bfd-5317-4174-9e7f-a1b893607065/what_does_timeless_design_mean.pdf
    • https://uploads.strikinglycdn.com/files/212d2615-0691-49ca-808b-5b793d72d692/kigagavodirawenabe.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000107a2.bin
e1b2f8887cfacbf9f971f279fcd7953ca4dbfd12304c427438c17afe4d29df54		 pdf-font-stream PDF embedded font (sfnt) at offset 0x107A2 5288 bytes
font_01_sfnt_off000119ae.bin
2719434a475a5310e7e53f65d41233fe394db4eb4410d656796ee46997c9ef4d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x119AE 11800 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.