Malicious PDF — malware analysis report

Static analysis result for SHA-256 3372b49b84602ccc…

MALICIOUS

PDF

100.7 KB Created: 2021-03-22 05:43:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: b81fd79182aa0f2396a7dd0e1e64b45e SHA-1: 402563b162c51243e5172193e933f77f31702a5e SHA-256: 3372b49b84602ccc7d290cfc9c86a5aea584e1b9e662aef861a7465f675eca0c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL, identified as a phishing lure. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, suggests it is masquerading as a manual to trick the user into visiting the malicious URL, which likely leads to a second-stage download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=onkyo+tx-+nr809+manual+espa%25C3%25B1ol PDF link annotation
    • https://ruxevikupasej.weebly.com/uploads/1/3/4/6/134663562/7029263.pdfIn PDF document text
    • https://cdn.sqhk.co/gotirawuz/gfB5Nge/medical_mini_stroke_tia.pdfIn PDF document text
    • https://minaraxu.weebly.com/uploads/1/3/4/7/134765114/ed1c784defd5d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465003/normal_604d34c789d25.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454971/normal_5fdf4faade977.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417990/normal_5ffa35c145e6d.pdfIn PDF document text
    • https://mewatejo.weebly.com/uploads/1/3/5/3/135322937/a286e5ae52.pdfIn PDF document text
    • http://fofolep.mywebcommunity.org/alexandre_dumas_los_tres_mosqueteros.pdfIn PDF document text
    • https://cdn.sqhk.co/vaxarogajib/Ulogeig/bubble_shooter_3_game_download_for_pc.pdfIn PDF document text
    • https://cdn.sqhk.co/ditetona/Kjf3SqQ/add_lock_screen_shortcut_mac.pdfIn PDF document text
    • https://ludolukek.weebly.com/uploads/1/3/4/6/134699908/f1486e9.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4423429/normal_6006e9eb30d23.pdfIn PDF document text
    • https://vipagavufedolaz.weebly.com/uploads/1/3/5/3/135350232/4439126.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/9816ac4c-50b2-4713-8e6a-b6481519b055/70321027319.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/00e9f5e3-7fc2-4fbd-860b-ce9c7ac8c7e1/what_is_first_second_and_third_estate.pdfIn PDF document text
    • https://s3.amazonaws.com/bepukuba/32765782832.pdfIn PDF document text
    • https://s3.amazonaws.com/wenobagupexekap/dawiwupumaralaza.pdfIn PDF document text
    • https://s3.amazonaws.com/popilo/39260032739.pdfIn PDF document text
    • https://s3.amazonaws.com/mefovu/stock_market_crash_march_16_2020.pdfIn PDF document text
    • http://laxuzoto.onlinewebshop.net/blue_white_flow_meter.pdfIn PDF document text
    • https://s3.amazonaws.com/zafibimutadoti/android_app_wlan_passwort_auslesen_ohne_root.pdfIn PDF document text
    • http://gagolabirej.atwebpages.com/54958536976.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001240c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1240C 5796 bytes
SHA-256: 82a227d27cb42c79ba1b0a13b2429f6913179a671042ce25209bc25a6d5fc2b5
font_01_sfnt_off00013778.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13778 11640 bytes
SHA-256: bec05f4be197de9df623cc71e8410ac5bc021cd71392de76b7ce1e9ae2d6f40d
font_02_sfnt_off00015f74.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15F74 16196 bytes
SHA-256: 2f9a721647dd746688308b0bec468334c1a6fd8bdadc0967584bb65b1e8ddee3
font_03_sfnt_off000174b8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x174B8 4324 bytes
SHA-256: 05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176

Open this report in the interactive analyzer, or submit your own file for analysis.