Malicious PDF — malware analysis report

Static analysis result for SHA-256 30a6494c6d222e37…

MALICIOUS

PDF

84.8 KB Created: 2021-01-27 18:27:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 1ce872ca75b079a93369c0df90c910b3 SHA-1: 6f23c4768f5dbed8720727d0213918bb1292932c SHA-256: 30a6494c6d222e3787d5503db36f52df7119d2b2497ea202c0c7a54c42f724d6
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, with heuristics indicating the presence of external URIs and LOLBin sequences. The embedded URLs, such as 'https://maypoin.ru/wb?keyword=iron%20food%20items%20in%20telugu', suggest a phishing or credential harvesting attempt. Although no scripts were explicitly extracted, the PDF structure and embedded URLs point towards a malicious intent to redirect users to harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wb?keyword=iron%20food%20items%20in%20telugu PDF link annotation
    • http://sifulodidikit.22web.org/artifactory_latest_snapshot_curl.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417325/normal_6003d2122ea81.pdfIn PDF document text
    • http://organize.shop/rosuzuwafomivogoxizedulizxiliv.pdfIn macro / runtime command snippet
    • https://cdn-cms.f-static.net/uploads/4408709/normal_600bf420a719f.pdfIn macro / runtime command snippet
    • https://cdn-cms.f-static.net/uploads/4482858/normal_5fea463dd5009.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4530868/normal_5fedca3b8155c.pdfIn PDF document text
    • http://redita.fun/music_id_app_free_download_offlines043b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4365606/normal_5feb3c7fde73c.pdfIn PDF document text
    • http://revujutipisan.22web.org/gopasaperowaladujazetu.pdfIn PDF document text
    • http://igonlinesupport.com/sofia_battle_arena_toshinden_gifaze5d.pdfIn PDF document text
    • http://picsonair.com/the_thin_book_of_appreciative_inquiry_3rd_editionwbbmg.pdfIn PDF document text
    • http://rolevuses.iblogger.org/rest_api_documentation_template_markdown.pdfIn PDF document text
    • http://hookup154.fun/police_chase_las_vegas_nevadaz83zv.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445733/normal_5fd9965d51bf9.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417325/In macro / runtime command snippet
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/roware/65488673706.pdfIn PDF document text
    • http://wudafozejuniv.rf.gd/gowivelilususafajuno.pdfIn PDF document text
    • http://ganesuk.epizy.com/cisco_crs-_8_s_datasheet.pdfIn PDF document text
    • https://s3.amazonaws.com/wuzalugiseto/biography_books_in_tamil_free.pdfIn PDF document text
    • https://s3.amazonaws.com/bogeguva/jovenitafulafediz.pdfIn PDF document text
    • https://s3.amazonaws.com/lupuvogotog/22131390965.pdfIn PDF document text
    • https://s3.amazonaws.com/wujanozo/zifalerazinebagosa.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f84e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF84E 4836 bytes
SHA-256: 0f3d1bad187e3bfc3a82eb6701facba285c55ca03e3fdb4d225d4575ec0cb922
font_01_sfnt_off0001089f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1089F 3720 bytes
SHA-256: 40ef96da86b6123d577d475be460de15c41b9ca7393a8e650be4e9942aa3c64b
font_02_sfnt_off00011401.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11401 10424 bytes
SHA-256: 0d1a2538ca4829dbb2552d46125d54833b903a7a5887205a6f7a0a40510b9d31
font_03_sfnt_off00013793.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13793 4324 bytes
SHA-256: 781b9fae2fb9201b4a05d2041fea553bb2973f1d011ab9c51e3326c72e342c60

Open this report in the interactive analyzer, or submit your own file for analysis.