Malicious PDF — malware analysis report

Static analysis result for SHA-256 3126ea2a4d1443e6…

MALICIOUS

PDF

80.7 KB Created: 2021-04-18 19:57:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0ef3613675ae0b3e5e81b7c6bff5308c SHA-1: 1652441ad4b27a6a393d9c622e0ae5f67025259f SHA-256: 3126ea2a4d1443e63bd219e3aaac33d6151f047632c46196d46539fd57115c1c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. The document body, though heavily obfuscated, appears to be related to search terms, suggesting a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=thule+roof+rack+jeep+grand+cherokee+2018
    • https://cdn.sqhk.co/noxuwitide/YWOTIOq/quick_tournament_maker.pdf
    • https://static.s123-cdn-static.com/uploads/4368742/normal_5fe22d4e77540.pdf
    • https://cdn.sqhk.co/zanotunuzi/idfgfHh/sacrifices_lyrics_devour.pdf
    • https://static.s123-cdn-static.com/uploads/4421207/normal_5fdd765355c2e.pdf
    • http://benilobodereji.mygamesonline.org/softgel_capsules.pdf
    • http://wewogokuwidu.mywebcommunity.org/inductive_and_deductive_theory.pdf
    • https://static.s123-cdn-static.com/uploads/4461511/normal_5ff1dcabb1e41.pdf
    • https://cdn-cms.f-static.net/uploads/4380863/normal_602a58003cf38.pdf
    • http://lamaded.mywebcommunity.org/57610771348.pdf
    • https://cdn-cms.f-static.net/uploads/4456685/normal_601d6a3c3a2d0.pdf
    • https://static.s123-cdn-static.com/uploads/4393790/normal_5fefdea0e3a70.pdf
    • https://cdn.sqhk.co/xurinuwame/Yojc5jc/eartha_kitt_i_want_to_be_evil_traduction.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/migivewuwe/cover_letter_for_overseas_job_template.pdf
    • https://f3dc8d0a-397f-4303-99a5-a7927e83d850.filesusr.com/ugd/e916cf_77864c2733ca43d09ae7d74abd33e150.pdf?index=true
    • https://676a7a22-5bec-432e-92e0-9d4a0a27851c.filesusr.com/ugd/a1fb72_cc11b37f40ae4e56952234043f68da6d.pdf?index=true
    • https://9e4d96d7-92f1-4145-9aac-d1976e75dfe6.filesusr.com/ugd/49a98b_83b9aa3c9ab9438397d7d863e7e5259b.pdf?index=true
    • http://fijumusuxolegoj.atwebpages.com/28514300689.pdf
    • https://40052bae-d6b0-4be3-9c84-96956a804c69.filesusr.com/ugd/32907c_4772c219ccaf45be8c205ced69b0fb1a.pdf?index=true
    • https://eee5dff6-7331-416e-acdf-593d0c386862.filesusr.com/ugd/21e9e0_a307f019428e4784932bfefad5d1cfed.pdf?index=true
    • https://s3.amazonaws.com/wazotojemov/tudenobawivemuj.pdf
    • https://s3.amazonaws.com/dovulavavo/1985304268.pdf
    • https://s3.amazonaws.com/suzujewa/cervical_cancer_management.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f961.bin
878f16349beb4dce383d1ef84ee5d9dca80379ff82a917a51b3d5dd96eddacb2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF961 5848 bytes
font_01_sfnt_off00010d4d.bin
64e32d37eb35e1dd9e6f07e563b71cfd2acc298a58d8b10933f411030dbfaf4b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D4D 11652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.