Malicious PDF — malware analysis report

Static analysis result for SHA-256 2e73c4ddfeb54c46…

MALICIOUS

PDF

73.3 KB Created: 2021-03-25 06:24:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 87a4e3d3725e84bf2b75b4e38658dedf SHA-1: 229f3f75dd30ebd9236ebcdba8f5a71d69e13455 SHA-256: 2e73c4ddfeb54c465be5fb0b08c43de77d80a3e0a80be425ba009e8aba577188
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, with a high ML score. It contains multiple embedded URLs, one of which is directly referenced in the document's metadata and appears to be a lure for search engine traffic. The presence of these URLs suggests the document is designed to redirect users to malicious sites, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=amc+8+2012+solutions+pdf
    • http://phrensy.co/57928561090sg76n.pdf
    • https://cdn.sqhk.co/suxumeva/agfgfji/lejusofipidabewipiti.pdf
    • https://cdn.sqhk.co/jaguwubax/hbYgcjg/10337697374.pdf
    • https://cdn.sqhk.co/gixobujikelu/wgjF116/50017629399.pdf
    • https://cdn.sqhk.co/javeduner/erngdrK/blood_pressure_monitors_omron.pdf
    • http://perfectiona.online/niluxalaperodizufoniwurkg1eu.pdf
    • https://cdn.sqhk.co/nazopekujavi/4IN6hgK/tati_youtube_subscriber_count_live.pdf
    • http://vashe-zdorovie.xyz/49002452346xm5c7.pdf
    • http://nelitip.22web.org/zidigajidaka.pdf
    • http://zawezumibinigot.iblogger.org/assessment_tools_definition.pdf
    • http://khareedforosh.com/bajabojurubavinugusjqpta.pdf
    • http://vostokzapad.su/mediafre_apk_brawl_stars4tz9c.pdf
    • http://a1metromovers.com/54154913925eqp0u.pdf
    • http://pawarelubasiwu.iblogger.org/how_to_work_out_net_profit_before_tax.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/a3bb4378-a1b6-4272-86f9-717a96e40ba1/2003_yamaha_kodiak_400_specifications.pdf
    • http://vurasoda.rf.gd/firewall_blocker_premium_apk.pdf
    • https://uploads.strikinglycdn.com/files/84a2fd96-18fd-474a-81c2-9a6ea11beb12/7611993816.pdf
    • https://uploads.strikinglycdn.com/files/c6578189-d0de-476c-b3ae-c16c011ef6f0/jiwofujexega.pdf
    • http://jajoxutevo.epizy.com/xejavuzisometanorinipoj.pdf
    • https://uploads.strikinglycdn.com/files/e7fb45c7-cc1d-4fa1-99f0-61b511eb8c12/tepuzinone.pdf
    • https://uploads.strikinglycdn.com/files/25d93112-5279-44f5-b4ba-12d72af14dda/xuzuwemabupazumoboxex.pdf
    • https://uploads.strikinglycdn.com/files/80d66b5d-8fba-4c07-b2eb-3b0cb3acb440/82639986938.pdf
    • https://uploads.strikinglycdn.com/files/884385ff-9cbf-4384-9229-cbd4df1cfe93/28121230648.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d239.bin
2752f57359a4be38cb4258c7b10ec3387ea6faecb5e3d4530b87aeb8e2794658		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD239 3688 bytes
font_01_sfnt_off0000df7f.bin
f95ee83b577a172bd89b8a2e761583eb2e1ab7bb0fd6b4bc9364ab8765cb7c8c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDF7F 5504 bytes
font_02_sfnt_off0000f23c.bin
df6079ad5cf987ea30085e00968f947844ad5a02c79094a0eaf1a628fa9e5b6f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF23C 10384 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.