Malicious PDF — malware analysis report

Static analysis result for SHA-256 30928e6cc4a10477…

MALICIOUS

PDF

83.6 KB Created: 2021-03-23 06:56:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 46bac1d02518da3c369554069997543f SHA-1: e6d6d33c4617857bc5cc7b36fd88207b7758c685 SHA-256: 30928e6cc4a1047709e858def3dac0db0f800b8239fe077593cf761ef215178a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, identified by ClamAV as a phishing trojan. The ML classifier also flagged the PDF with high confidence. The document body, though heavily obfuscated, appears to contain keywords related to immigration, suggesting a lure for phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/award?keyword=immigration+rules+appendix+fm+pdf
    • http://nanebaxexob.getenjoyment.net/how_to_draw_with_your_right_brain.pdf
    • http://manovina.mypressonline.com/ms_sql_server_2012_support_lifecycle.pdf
    • http://lozejebivo.scienceontheweb.net/abstract_tesi_esempio.pdf
    • http://tutavizukatafoz.22web.org/calendario_laboral_barcelona_2020.pdf
    • http://boost-shop.xyz/esfolio_pure_skin_milk_essence_mask_sheetyf4yf.pdf
    • http://copyrighthelpbusiness.net/pomitaltkh6.pdf
    • http://sugameloxufe.mywebcommunity.org/65330183004.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://palipesokugukux.epizy.com/xufidotebopazi.pdf
    • https://uploads.strikinglycdn.com/files/d7f9c9b8-330e-41f4-acfe-a334c3a1b2df/maschine_mikro_mk1_review.pdf
    • http://kadoxosin.atwebpages.com/us_navy_uniform_regulations_boots.pdf
    • https://uploads.strikinglycdn.com/files/b60f1d4a-4268-409c-9dd2-ae88598e10ea/jamaica_images_clip_art_stars.pdf
    • https://uploads.strikinglycdn.com/files/8aef6747-dc7a-4970-b2b6-eb39413a6ff3/sipuxomekojajuxibibowa.pdf
    • https://71e5fc8e-cc9a-4633-96c3-2c70acd464d0.filesusr.com/ugd/f08e01_5d62337cb94b46479fa4910292e8a16f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/165a60fd-3ae5-4870-a9df-a116f4a15871/resumen_del_libro_la_metamorfosis_por_capitulos.pdf
    • https://f4dd034e-00c7-465c-b850-fb2d75accad5.filesusr.com/ugd/769f78_51e726d729364b08967ed426d9540f4d.pdf?index=true
    • https://uploads.strikinglycdn.com/files/58c46479-b181-4b48-ba26-36d62a98b4f6/kujulisabaxufopa.pdf
    • http://pakurowomeki.rf.gd/spatial_data_analysis_an_introduction_for_gis_users.pdf
    • https://6ec3981f-6443-463b-a164-91fc69f101d9.filesusr.com/ugd/7603ae_3b82fd6ecae04ac0a38f73be5ee71dda.pdf?index=true
    • https://98cdd5c5-c43e-49eb-9373-39517e896cbb.filesusr.com/ugd/90661f_baada93903634213a07cd54093bb85c9.pdf?index=true
    • https://d89d6b52-6e76-4e18-bccb-bd7428cfddad.filesusr.com/ugd/02beb7_1c72289ff2cd4b8297e28fa95b944d61.pdf?index=true
    • https://466f9527-ada3-48b4-ac0c-4ba5546996ca.filesusr.com/ugd/a4b6b9_55c95e57daca4025bb60964f07f8abcf.pdf?index=true
    • https://4f640d82-8365-4c22-93d6-dbd3427c3fb0.filesusr.com/ugd/55e8b7_053bc7c9038d49adb018de7bf9167de1.pdf?index=true
    • http://fedepor.rf.gd/schwinn_ic3_indoor_cycling_bike_weight_limit.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001092b.bin
6f2affaa8d0295a05c02481b118737c39ca3379398b975edabc3bf47788cd4d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1092B 5368 bytes
font_01_sfnt_off00011b5a.bin
5d59041c57e85cc0a90def9c95c9abc4eebd971e5f3f76a607ec47353a307718		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11B5A 11072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.