Malicious PDF — malware analysis report

Static analysis result for SHA-256 2d16fb642c0efb3f…

MALICIOUS

PDF

73.8 KB Created: 2021-02-24 10:30:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 5c779f766ff1724b9e9672cb705f4032 SHA-1: f88f467a1bee5bd1639492281c95fd9435731050 SHA-256: 2d16fb642c0efb3f6308844406eeac7ef15a72835137c845d0f6d23bbf46527e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL pointing to 'leonvi.ru', which is highly suspicious and likely serves as a lure for malicious activity. The document body, though heavily obfuscated, suggests a deceptive pretext related to drawing lines, possibly to mask the true malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/strik?utm_term=how+to+draw+a+straight+line+y%253Dmx%252Bc PDF link annotation
    • https://cdn.sqhk.co/posiraki/jOQfdhe/sputnikmusic_best_albums_of_2000.pdfIn PDF document text
    • https://cdn.sqhk.co/gedodupem/bjjTZtJ/lovamogulububufawo.pdfIn PDF document text
    • http://strahauto.website/free_mailing_label_template_wordos42i.pdfIn PDF document text
    • http://keysecret.ru/diablo_3_ros_save_editor_xbox_360fb07e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4413110/normal_5ffd29071f6f2.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4368748/normal_5ff5ad71adae4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4413346/normal_60082e29d53fe.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4421767/normal_5feb5cb7e79b1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449627/normal_600bc5721e32d.pdfIn PDF document text
    • http://private-channel.site/chicken_little_storyhi8n1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4487208/normal_60046a50422ef.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4381287/normal_5fce791237301.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486548/normal_600fbdd658745.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jufowokedunod/tisakuviripasojupoma.pdfIn PDF document text
    • https://s3.amazonaws.com/jixerubowi/mrp_1xcs_chain_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/poresi/computer_hardware_crossword_puzzle_answers.pdfIn PDF document text
    • http://nabunuwo.epizy.com/xatasajufigagewidi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd73.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDD73 5620 bytes
SHA-256: 58a737d7cf94ba641e90bacec734541aac3ef0f06a11e5a7a2f1a9d494482656
font_01_sfnt_off0000f07e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF07E 11804 bytes
SHA-256: 9d933d8aa6e1a4a7c9a48b56ec469e5357c47410469fbbb7bcf576a92a3b86f7

Open this report in the interactive analyzer, or submit your own file for analysis.