Malicious PDF — malware analysis report

Static analysis result for SHA-256 2d07e4730d7e30ec…

MALICIOUS

PDF

78.4 KB Created: 2021-03-23 14:28:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c7451bfef49b5a3a91370ff0eb5cd71e SHA-1: 252c93ceb24fbc438a77da0c01b266510985fda2 SHA-256: 2d07e4730d7e30ec98529e2a20f2f49d189804d6ca0cf4c349c61e2f346cd9e7
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The document body, though heavily obfuscated, contains keywords related to 'TV guide' and 'champaign illinois', suggesting a lure. The presence of an external URI indicates an attempt to redirect the user to a malicious site, likely for phishing or to download further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9964

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=tv+guide+champaign+illinois
    • https://cdn.sqhk.co/ravusigi/emgcfgi/idle_hotel_tycoon.pdf
    • https://cdn.sqhk.co/nebinefis/eiggceb/facts_you_should_know_about_your_best_friend.pdf
    • http://bewudewumit.sportsontheweb.net/24623390559.pdf
    • https://cdn.sqhk.co/zavilisuga/z9rgdRh/22044797540.pdf
    • https://cdn-cms.f-static.net/uploads/4460690/normal_603e7ca2d59d7.pdf
    • https://cdn-cms.f-static.net/uploads/4369158/normal_6014f990901df.pdf
    • https://cdn.sqhk.co/konajera/hhhiVLi/skin_for_among_us_wallpaper_engine.pdf
    • http://bagezokazuraw.medianewsonline.com/garmin_740s_replacement_parts.pdf
    • https://cdn-cms.f-static.net/uploads/4419002/normal_603f00633038c.pdf
    • https://losanuritajog.weebly.com/uploads/1/3/4/7/134730792/1d5ef94c.pdf
    • http://wefufivubulal.medianewsonline.com/basic_civil_engineering_ss_bhavikatti.pdf
    • https://cdn.sqhk.co/bokupajokim/h8lnmvX/swiss_national_hockey_league_schedule.pdf
    • http://woziwowariv.sportsontheweb.net/puppy_temperament_test.pdf
    • https://sivusizawijavoj.weebly.com/uploads/1/3/4/4/134482483/sexad-zokufekokomop.pdf
    • https://cdn-cms.f-static.net/uploads/4443803/normal_604f5f2a67396.pdf
    • https://static.s123-cdn-static.com/uploads/4389801/normal_5fe052320995c.pdf
    • http://xenakasewexibal.sportsontheweb.net/texinulexofozulad.pdf
    • https://jewakazakiven.weebly.com/uploads/1/3/1/4/131437085/3972571.pdf
    • https://karoxenerom.weebly.com/uploads/1/3/0/7/130739074/nijuxo_ruriniwo.pdf
    • http://sazinoz.mypressonline.com/bujupesesime.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://piwakitidi.onlinewebshop.net/41817720884.pdf
    • https://uploads.strikinglycdn.com/files/ae910f50-4119-4db2-8a57-2e680508aed2/2013_jeep_grand_cherokee_overland_5.7_hemi_towing_capacity.pdf
    • http://xunudijumo.myartsonline.com/biogeochemistry_of_a_forested_ecosystem.pdf
    • http://gurabagoderes.atwebpages.com/95943144357.pdf
    • http://dirulibas.onlinewebshop.net/add_text_to_using_microsoft_edge.pdf
    • https://uploads.strikinglycdn.com/files/b0ddd7f6-7c35-4156-baeb-49526848a8a7/append_text_to_log_file_c.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4d6.bin
722d5c2f43c107e10c034048328662367b41135489ae45e4777a6e295d77d4f8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4D6 5400 bytes
font_01_sfnt_off00010719.bin
816993c2f867b3b8e02e3f846c3c0695f7a4c870605f55ac101bec301fcf6d87		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10719 10932 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.