Malicious PDF — malware analysis report

Static analysis result for SHA-256 3343e620cc92a81f…

MALICIOUS

PDF

77.2 KB Created: 2021-03-07 07:40:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 983eeb9eb85a976a7f742e4b86c0e189 SHA-1: 50a85ad25418ff9e0b1ace73ee0332f79a7c42e0 SHA-256: 3343e620cc92a81fef418228b82c7eec96eaabb541439fbf73d3a07e6b3bca0d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site for further exploitation. The document body, though heavily obfuscated, contains references to 'White rodgers 1f78-144 reset', suggesting a pretext for the phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/123?utm_term=white+rodgers+1f78-144+reset
    • http://budivev.scienceontheweb.net/37412520511.pdf
    • http://zawopim.mygamesonline.org/what_does_rattlesnake_mean_in_french.pdf
    • https://static.s123-cdn-static.com/uploads/4426073/normal_5fffc0b265218.pdf
    • https://static.s123-cdn-static.com/uploads/4446937/normal_5fff126ac2d87.pdf
    • https://cdn-cms.f-static.net/uploads/4383918/normal_60316c726f980.pdf
    • https://cdn-cms.f-static.net/uploads/4492871/normal_602a1ced68019.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/14f6a5b5-794a-4b71-b939-b54d0941d38e/how_to_heal_developmental_trauma.pdf
    • https://s3.amazonaws.com/lefemijip/29880749891.pdf
    • https://uploads.strikinglycdn.com/files/f889bcf0-a5a8-4a4d-8385-9d68d6a382cf/vojom.pdf
    • https://s3.amazonaws.com/zuxime/cisco_firepower_2100_series_hardware_installation_guide.pdf
    • https://uploads.strikinglycdn.com/files/0e4f24c1-bff2-499d-81ed-4e250993032e/juterexunizomukavazesoni.pdf
    • https://uploads.strikinglycdn.com/files/2866bee8-e877-470f-b5b7-0cad3cce4357/are_there_any_more_percy_jackson_books_after_the_last_olympian.pdf
    • https://uploads.strikinglycdn.com/files/05cfb0ac-d710-4924-8c50-e5889ab6094d/24148268368.pdf
    • https://uploads.strikinglycdn.com/files/cd08a83c-2c73-45fc-8123-f68ab17c3bf5/how_to_drain_a_ge_water_softener.pdf
    • https://uploads.strikinglycdn.com/files/49faf060-930b-424e-ad73-f638f8fcae92/23059474270.pdf
    • https://uploads.strikinglycdn.com/files/d6fa1feb-6d3f-4f23-a4d6-58918bb30522/pazijeruzukom.pdf
    • https://s3.amazonaws.com/jazuravazaguz/static_electricity_activity_worksheet.pdf
    • https://uploads.strikinglycdn.com/files/25802733-0d6f-454c-ae99-39c7f950dd15/ge_24927_8-device_universal_remote_control_manual.pdf
    • https://uploads.strikinglycdn.com/files/1dd7a3a7-48ed-4c4f-aa5c-5716881b0b9d/frostgrave_second_edition_download.pdf
    • https://uploads.strikinglycdn.com/files/76d1b9d5-9c04-4bef-b008-9fdb11bd0ae9/bununiridonuviwadikerof.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e37a.bin
196a53605c8fb085f51ba88761cb1369a340f96df5fdd240a77ed6e234c13bfc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE37A 5068 bytes
font_01_sfnt_off0000f4f9.bin
d78552aba2b41ea690260fd9f6ffd98941671d9b4e17a850948941baca7dbdbc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4F9 10712 bytes
font_02_sfnt_off0001198f.bin
a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1198F 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.