Malicious PDF — malware analysis report

Static analysis result for SHA-256 338f5fb99b58ac9c…

MALICIOUS

PDF

85.7 KB Created: 2021-03-27 21:37:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f03a24ccbbf90f8ded1646282e5eaacc SHA-1: 1ce80433c06e47a36c51230bc0054e1693641618 SHA-256: 338f5fb99b58ac9c17f0c43bdf4265e3733bb80912628d24ab40aa383bc0d89a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL, which is likely intended to redirect the user to a malicious site. The ClamAV detection and ML classifier strongly indicate malicious intent, classifying it as a phishing trojan. The presence of embedded URLs and the nature of the PDF suggest it's used as a lure to download further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=ap+biology+syllabus+2020+college+board
    • https://cdn.sqhk.co/rotonoba/4hgnaPf/57869814400.pdf
    • https://cdn.sqhk.co/jedugifaxido/sgdjeje/new_brunswick_college_of_craft_and_design_fredericton.pdf
    • https://cdn.sqhk.co/bepemuno/ZkCQqgd/angie_s_list_appliance_repair_plymouth_mn.pdf
    • https://cdn-cms.f-static.net/uploads/4384480/normal_60141c771b25c.pdf
    • https://cdn-cms.f-static.net/uploads/4383137/normal_6026e1db3160f.pdf
    • https://static.s123-cdn-static.com/uploads/4392658/normal_5fff16f1c3258.pdf
    • http://bivebojulop.iblogger.org/adobe_flash_professional_bagas31.pdf
    • http://najefot.22web.org/70196971051.pdf
    • https://cdn-cms.f-static.net/uploads/4416806/normal_60562d8fe72a0.pdf
    • https://static.s123-cdn-static.com/uploads/4448115/normal_5fdfb34451e81.pdf
    • https://cdn.sqhk.co/jijatidos/UgfiLhe/zofilodanuzeg.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/e50ba4db-56f5-47d6-8af4-b9d3d7295000/razagugokepixesolo.pdf
    • http://saduxax.epizy.com/vevib.pdf
    • https://uploads.strikinglycdn.com/files/313d98de-86b3-4baf-97b7-28c1bf1d92ab/33040191372.pdf
    • https://s3.amazonaws.com/kabisebax/44945006895.pdf
    • https://f72e0e13-a873-49c5-9cb5-3c2848b8c5b2.filesusr.com/ugd/f8ba4b_65d47bc7d34848edbd3440f2753447cb.pdf?index=true
    • https://s3.amazonaws.com/paropabaru/vinonafupu.pdf
    • https://305aa2e3-e1d2-413d-aa2e-f1bb83d03ded.filesusr.com/ugd/92ee2b_6cf7a38688c64ad1b4e6afdb0ab9eb90.pdf?index=true
    • https://8ea4a4fb-2859-49e6-8c89-66ed49166bb4.filesusr.com/ugd/0088c1_ce4d353fb94c4637bffbd31d67617964.pdf?index=true
    • https://uploads.strikinglycdn.com/files/9489d2b7-d0c3-45cb-b976-47bd1ecd741b/polagegawa.pdf
    • https://uploads.strikinglycdn.com/files/624df3e3-4c3f-479d-94c6-81d99d430886/javorokumogu.pdf
    • https://01c4c9a3-ee74-4db9-a65d-799443b8dbf1.filesusr.com/ugd/a64c8c_f55de9eb812848f99b043bb82e537089.pdf?index=true
    • http://nuridoxiwe.rf.gd/aspirina_en_el_embarazo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001109f.bin
271ef64ada71b839ea2a17749cef756fc1a15ac467c2a737e5c6e5c5ab45f6fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1109F 5748 bytes
font_01_sfnt_off00012444.bin
fabed0f89c1d81690088a0018d4a8f0ada168692e0dfdee39a89be2e3adc394f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12444 11016 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.