Malicious PDF — malware analysis report

Static analysis result for SHA-256 331c35c07f68c521…

MALICIOUS

PDF

77.4 KB Created: 2021-04-09 15:01:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6dd9b790d0e34e0e6a85b0aaae2920ba SHA-1: b92f2a724dcd9fc79140c3f372ef1825b4bd96fb SHA-256: 331c35c07f68c521752b4e095256c23bf6b1093a5d6e2f51d92a27f4dd399b56
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing an embedded URI pointing to a suspicious domain, identified as malicious by ClamAV and ML classifiers. The document body, though heavily obfuscated, contains references that, combined with the URI, suggest a phishing or malware distribution lure. The presence of embedded URLs and the overall detection by security tools indicate a malicious intent to redirect the user to a harmful resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=ebay+uk+karcher+pressure+washer+spares
    • http://alex-chekalev.com/faloxowuxedobedosalorikahfx6l.pdf
    • http://arthromedshop.xyz/befogo0w4lu.pdf
    • https://jajelawipazug.weebly.com/uploads/1/3/0/7/130739535/a3bd145a0f156c0.pdf
    • https://cdn-cms.f-static.net/uploads/4445737/normal_606697496b096.pdf
    • http://luxibenuguk.getenjoyment.net/71352994303.pdf
    • https://sugelama.weebly.com/uploads/1/3/4/8/134898925/9522041.pdf
    • https://cdn.sqhk.co/minamojazi/6Lgigc0/warfare_global_operations_pvp_online_shooter_3ds.pdf
    • https://cdn.sqhk.co/vawapisoxe/gtjijM9/microsoft_word_2010_user_guide_template.pdf
    • http://lnstagramsupportinfo.com/rojuwapipiwarew3xi1o.pdf
    • https://cdn.sqhk.co/zejegure/CfCsjfI/63377791832.pdf
    • http://taxutipepavij.iblogger.org/49013559218.pdf
    • https://cdn-cms.f-static.net/uploads/4494668/normal_60180049d0dd3.pdf
    • http://perevod24-card2card.site/pobomofewanezawogilz3wyd.pdf
    • http://zibalada.iblogger.org/17111227320.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://pumikowexudat.onlinewebshop.net/92454390004.pdf
    • http://nanaxidimidi.atwebpages.com/pharmacology_of_antihypertensives.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f06b.bin
ea2ed5b78b376a30cdf9081b19e3fc264e52e1a158e535cf0c8f214e151e2398		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF06B 5344 bytes
font_01_sfnt_off000102ad.bin
5c947411f26222cf3f2b9e1514b48854dea2fc23482ebf682917f09c30360e55		 pdf-font-stream PDF embedded font (sfnt) at offset 0x102AD 11124 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.