Malicious PDF — malware analysis report

Static analysis result for SHA-256 337b7fe2d7065922…

MALICIOUS

PDF

81.0 KB Created: 2021-04-02 22:42:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 576c31f7e46cb4e1b463633f23678fdf SHA-1: d35f94b6f6c46733e1e7bdf9a733b33f95fb0ecc SHA-256: 337b7fe2d7065922d420b1b81121e25f6d932a9c4df1f799771452dd493df61a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that directs users to a site offering a 'Blender 3d program free', indicating a phishing or scam attempt. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan. While no scripts were directly extracted, the presence of external URIs and the overall classification strongly suggest a malicious intent to redirect users to a potentially harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/123?utm_term=blender+3d+program+free
    • http://ragofilud.medianewsonline.com/systematic_theology_vs_biblical_theology.pdf
    • http://bulepozobagepud.mygamesonline.org/posagepidilenupepe.pdf
    • http://modozadubop.mywebcommunity.org/what_causes_ketoacidosis_in_cats.pdf
    • http://lumobumekola.getenjoyment.net/wolves_of_the_calla_illustrated_edition.pdf
    • https://cdn.sqhk.co/mesojofu/hdicjho/trending_instagram_hashtags_in_nigeria_today_2019.pdf
    • http://fakexexu.sportsontheweb.net/77471944749.pdf
    • http://zinefikitozozeg.sportsontheweb.net/xavulunelalenodumiluraza.pdf
    • http://bupitubegedew.getenjoyment.net/english_worksheet_for_adults.pdf
    • https://cdn.sqhk.co/rifarako/hgfXQgh/auto_reply_for_fb_messenger_auto_response_bot.pdf
    • https://cdn.sqhk.co/jugomuzuteb/hehbidr/kiki_name_meaning_japanese.pdf
    • http://nunovoxiwanafuz.getenjoyment.net/autosar_diagnostics.pdf
    • https://cdn.sqhk.co/sabumijobude/Fjbgd84/42561420628.pdf
    • http://wovuwukotuvoxi.mygamesonline.org/arrhythmias_ecg.pdf
    • http://tijudozi.scienceontheweb.net/una_historia_de_la_lengua_castellana.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://1ce8651a-bfbb-4b9a-b1bf-24b3b574775a.filesusr.com/ugd/ac72e0_7853c2d6fd3642fe84d08fdc1ff4c4b6.pdf?index=true
    • https://f2203da8-4034-475c-a980-a37079f2cd7f.filesusr.com/ugd/d29026_b4b4ae1234ad4ff98c676d5789218806.pdf?index=true
    • https://uploads.strikinglycdn.com/files/90a7fbc7-fb10-4ad5-9e1e-e360f1b11d9a/guitar_chords_songs_opm.pdf
    • https://uploads.strikinglycdn.com/files/ee7326a6-dacc-49fb-971e-a656e82a2ec3/plain_english_for_lawyers_by_richard_wydick.pdf
    • https://88966db1-4a83-4446-b941-f65022a6235f.filesusr.com/ugd/928e0f_d239ffa1fb6541d6ba212a4f82279017.pdf?index=true
    • https://uploads.strikinglycdn.com/files/97121f55-99a0-4364-88be-244e9df68960/97667258546.pdf
    • https://d3826037-6016-486c-99e9-dc41bc666644.filesusr.com/ugd/b81754_b9e4db055fc64bb7a59ce8ba5889e7df.pdf?index=true
    • https://94ac7338-8c66-48ed-b7e4-01cccba3eff0.filesusr.com/ugd/9b8421_ce9d2b35588642c288c46e46e5a1198b.pdf?index=true
    • https://e9542b43-fb79-4c62-94a9-c66526381fce.filesusr.com/ugd/4142f3_aeb97f6461a645d4bd9f474deb7aecf1.pdf?index=true
    • https://aa6d2f86-95e2-42cc-897e-6bbd71c3a116.filesusr.com/ugd/78daac_ee6b3b3961704f1d85e9851c71d87e41.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e85aa849-fbdd-4eaf-9e6d-bd334062e8a6/can_praying_cure_depression.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fe80.bin
3478ec03fc7e90479a6452196e02533b77196cc43666ce56e44761f9be27caae		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE80 5396 bytes
font_01_sfnt_off000110cd.bin
f3f2a72551e94ed671f7c08b6fc12cbea61c6e862cf5e7c63b4ee0eb943cdefc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x110CD 10984 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.