Malicious PDF — malware analysis report

Static analysis result for SHA-256 32ef9395ff66aea1…

MALICIOUS

PDF

104.8 KB Created: 2021-04-03 20:33:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fe942bab97dd2fb4364d2c9b8f758efa SHA-1: b8a4f0ea3b0d3ca6e99ed8987884c039b76c7319 SHA-256: 32ef9395ff66aea168fbfbd1322db4fc0a3903f5382ab1dea8a13729b8fa2305
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The ML classifier and ClamAV detection strongly indicate maliciousness. The PDF contains an embedded URI pointing to a suspicious domain, which is likely used to host phishing content or download further malware. The document body, though heavily obfuscated, suggests a lure related to stock trading, aligning with phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=how+to+buy+stock+in+canada+rbc
    • https://wudatoguji.weebly.com/uploads/1/3/4/8/134885495/b0e0bc5cfdd.pdf
    • https://static.s123-cdn-static.com/uploads/4453721/normal_5ff7cad1c9a35.pdf
    • http://copriyghtconfirmed.com/the_great_stupa_at_sanchizlkaq.pdf
    • http://online-bestshop.xyz/zudigunetej7qta5.pdf
    • https://static.s123-cdn-static.com/uploads/4460966/normal_5fe1a29da0fed.pdf
    • http://lowabunuzoxa.getenjoyment.net/advanced_computer_architecture_text_book.pdf
    • http://rakapugijumub.sportsontheweb.net/1606159311.pdf
    • https://bitoranajezope.weebly.com/uploads/1/3/1/4/131453137/vitepuki.pdf
    • https://fomilapemarujan.weebly.com/uploads/1/3/0/8/130814088/doxudi.pdf
    • https://cdn.sqhk.co/bosesegivu/hic6fz7/25116023706.pdf
    • http://about-central.com/75313527200lulb7.pdf
    • https://xowogibudul.weebly.com/uploads/1/3/4/4/134446034/4655b3d1783d.pdf
    • https://cdn.sqhk.co/vegubefeno/jjjhbcv/zombie_defense_apk_download_uptodown.pdf
    • http://moitender.org/18334451632xrrcl.pdf
    • https://static.s123-cdn-static.com/uploads/4391599/normal_5ff37aba7bdba.pdf
    • http://reduslimitalia-ufficiale.site/convert_to_jpg_adobe_reader_dcz4hf5.pdf
    • https://neritakewu.weebly.com/uploads/1/3/1/8/131856632/tabobasixigi_kodumugorumabet_nabaw_gosag.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/cd2e69ce-cfcd-4719-8d57-c47c21701a49/how_has_the_clock_changed_over_time.pdf
    • https://uploads.strikinglycdn.com/files/26eabb68-907f-41c7-942b-db4a0ff1bd0e/31597198862.pdf
    • https://uploads.strikinglycdn.com/files/85e45a25-e5e2-40cb-9f53-efaa0a52d115/62798597856.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011d6e.bin
aa0c292bb115f63330977e03c16107911a14a23f2846a6cbd53b83eb9622cb59		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11D6E 5260 bytes
font_01_sfnt_off00012f6c.bin
c7e2d029e3a7549e3f554cfd305f6a9283a0a4e883b4e8b082740337ef415ec4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12F6C 13696 bytes
font_02_sfnt_off0001598b.bin
6a46dda78795dc8ffa3a39ce17221df37641a2bac4b077e11c708cb2b5d6831e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1598B 11512 bytes
font_03_sfnt_off000180a2.bin
354dce64f07f3d7acdf6a04edf763950ffbfec4edcbb4bfe17b65a83544077bb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x180A2 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.