Malicious PDF — malware analysis report

Static analysis result for SHA-256 2df217eb32584504…

MALICIOUS

PDF

75.7 KB Created: 2021-03-08 23:57:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7619aac91ed8e95d1f7431b8c13e9df5 SHA-1: 5b06ab3e9b3824e5b8ff261c254e8a26ad826a9a SHA-256: 2df217eb325845041671ea947ecea44d0dadd480faf28fb688db617dab4f825c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL. The ML classifier and ClamAV detection strongly indicate maliciousness. The embedded URL likely leads to a phishing or malware download site, disguised as a document about human resource management terminology. No scripts were extracted, but the PDF structure and embedded URI are indicative of a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/award?keyword=human+resource+management+terminology+pdf
    • https://static.s123-cdn-static.com/uploads/4411916/normal_5fcb4df524a0d.pdf
    • https://static.s123-cdn-static.com/uploads/4427085/normal_5fcaa3ae8b149.pdf
    • https://cdn.sqhk.co/dubikureta/bigSjbB/pejazowib.pdf
    • https://cdn-cms.f-static.net/uploads/4489843/normal_6017def364724.pdf
    • https://cdn-cms.f-static.net/uploads/4476123/normal_6028b83212933.pdf
    • https://cdn.sqhk.co/karopepagu/nEZpjeQ/63183228249.pdf
    • https://cdn-cms.f-static.net/uploads/4468270/normal_6032a4302ef20.pdf
    • http://fedezin.scienceontheweb.net/keurig_2.0_parts.pdf
    • http://jarevine.mywebcommunity.org/59762549124.pdf
    • https://cdn.sqhk.co/wosuzumamig/nYkgfji/62016633323.pdf
    • http://xorabawik.medianewsonline.com/80825598574.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://d2ea4bfc-f92a-4379-acf2-d9b69981ddb7.filesusr.com/ugd/739437_7b69c9a9101948529c9af9654a22e008.pdf?index=true
    • https://s3.amazonaws.com/wefadep/71639486767.pdf
    • https://f8ba888e-8f71-4fde-8303-550399648f4e.filesusr.com/ugd/17ce20_90e6356d808e4d11a18137ef2c604a19.pdf?index=true
    • https://03aaa7dd-6608-466c-a68c-f41c59811c05.filesusr.com/ugd/ae15ca_c7a231776e244cde8dd5ed16d1a5cc82.pdf?index=true
    • https://77483064-5892-4b52-b419-66e751946b77.filesusr.com/ugd/ef7b09_021521e462e845bb8a8f56b23d8ea51b.pdf?index=true
    • https://s3.amazonaws.com/jiwisigetizoxif/88897664819.pdf
    • https://s3.amazonaws.com/besafefaf/ema_variation_guideline_2013.pdf
    • https://uploads.strikinglycdn.com/files/22d334ca-be77-491f-a8ae-63ba3e29ba89/what_is_a_good_a1c_level_chart.pdf
    • https://s3.amazonaws.com/fadupazageraf/betumogufebazekefutufexeg.pdf
    • https://uploads.strikinglycdn.com/files/ce6b63ac-1152-4985-9489-d3291c91f15c/90369462407.pdf
    • https://uploads.strikinglycdn.com/files/50dfda0c-091c-47d2-b033-7cf2a0455733/nasuk.pdf
    • https://uploads.strikinglycdn.com/files/a8e5a5ac-169a-4340-aae0-fe9225d74245/81881252618.pdf
    • https://d1ee23ee-9ccf-45b0-80ef-1e1ff1f657c4.filesusr.com/ugd/9ef0c3_55e2d865a8174bbf833c829f36292e39.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e7b0.bin
1d4d2d3b68205426b9f1c3a600fee504654d14e014f01c0c04425f817e76b642		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE7B0 5536 bytes
font_01_sfnt_off0000fa72.bin
4195ca78301ec4f535844a7e6f44e64a781cc79dd5551f35795d975b51438003		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA72 10848 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.