Malicious PDF — malware analysis report

Static analysis result for SHA-256 30ed6a6285d07fe5…

MALICIOUS

PDF

109.9 KB Created: 2021-03-30 19:46:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: da9bef9c620bcb67f31576bdb7890a17 SHA-1: da98aba374ed5d522150bd48a620eca27b48640a SHA-256: 30ed6a6285d07fe5f84cd3d2fe6cce96764fbd8997c30fb48db4d8c0ecd200d3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI that directs the user to a website disguised as a vehicle owner's manual, likely a phishing lure. ML and ClamAV heuristics strongly indicate maliciousness, classifying it as a phishing trojan. Although no scripts were explicitly extracted, the PDF structure and embedded URLs suggest an attempt to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wix?keyword=2009+nissan+rogue+sl+owners+manual
    • https://static.s123-cdn-static.com/uploads/4366017/normal_5ffb6c86de592.pdf
    • https://jubunukaf.weebly.com/uploads/1/3/1/4/131483214/98db50.pdf
    • https://cdn-cms.f-static.net/uploads/4445333/normal_604058e861343.pdf
    • https://nogulakotu.weebly.com/uploads/1/3/0/9/130969216/zegepubusolo-vesewe.pdf
    • https://paripipedaninez.weebly.com/uploads/1/3/4/4/134444050/e548feac.pdf
    • http://numulul.mygamesonline.org/ravewuguxabobev.pdf
    • http://betijeduw.getenjoyment.net/what_are_the_names_of_the_musical_symbols.pdf
    • https://cdn-cms.f-static.net/uploads/4420602/normal_601f138e76fb9.pdf
    • http://gexulogoben.sportsontheweb.net/magnification_of_microscope.pdf
    • http://lalikexitaxixix.getenjoyment.net/savabanas.pdf
    • http://navevukosuso.mypressonline.com/jununosu.pdf
    • http://wapividazofar.scienceontheweb.net/44087025939.pdf
    • http://tonilakifak.mypressonline.com/ginodajogisudeku.pdf
    • http://fajiriduxir.medianewsonline.com/pdf_to_word_conversion_online_without_email.pdf
    • http://gejejasofubi.mywebcommunity.org/bhagavad_gita_english_iskcon.pdf
    • http://gavokofubafixi.getenjoyment.net/ncert_books_class_11_and_12_chemistry.pdf
    • https://sesifubonimexa.weebly.com/uploads/1/3/5/3/135317238/bekajifud_tegababatalaj_wevizigowut.pdf
    • https://cdn-cms.f-static.net/uploads/4446761/normal_601dc3187bafd.pdf
    • http://kimujedat.mygamesonline.org/altaf_hussain_hali_poetry_in_urdu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://limuzer.atwebpages.com/blynk_arduino_tutorial.pdf
    • http://juwukopegonamu.onlinewebshop.net/clemastinum_aflofarm_ulotka.pdf
    • http://nejimafalun.onlinewebshop.net/when_to_remove_infant_insert_in_car_seat_maxi_cosi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00017299.bin
7fade9cdbf44143f28ee361aa8a054ba32859cee01b5782b38185fab2f934e91		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17299 5432 bytes
font_01_sfnt_off0001850b.bin
a6431f3c92465e2b21469169b76a64637b5c2ef807f1ad673e8af17cb53f8afb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1850B 10964 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.