Malicious PDF — malware analysis report

Static analysis result for SHA-256 339ba4056425f8d5…

MALICIOUS

PDF

58.3 KB Created: 2020-11-13 13:55:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c482471760b53d09f0120bdee59363e8 SHA-1: 53837a0fcefec4ed2b6c6a5b9505b2a5e3d90792 SHA-256: 339ba4056425f8d58214a000602eacab47fed5f85d1bca6f7c0775aa21f1f077
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains an embedded URL that leads to a phishing site, masquerading as a search result for a common query. The ML classifier and ClamAV detection strongly indicate malicious intent. No scripts were extracted, but the presence of a malicious URL is sufficient to classify this as a phishing attempt delivered as an attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/123?utm_term=23+degrees+celsius+is+how+much+fahrenheit
    • https://cdn-cms.f-static.net/uploads/4366337/normal_5f8aa33525b4f.pdf
    • https://cdn-cms.f-static.net/uploads/4391620/normal_5f92069f724b4.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/6e9ecd67-1c8b-434e-81bf-fbc728fa569c/amari_hua_hin_condo_for_sale.pdf
    • https://uploads.strikinglycdn.com/files/8d850bb2-4897-43f2-8327-754fdcfbb58a/63453156980.pdf
    • https://s3.amazonaws.com/wukara/26172225463.pdf
    • https://uploads.strikinglycdn.com/files/e65d82da-d7b2-45e5-92fc-bcf9bf988f54/xabitifiregun.pdf
    • https://uploads.strikinglycdn.com/files/e858d301-1fb2-4e5d-928f-da1f236cdae8/81961948858.pdf
    • https://s3.amazonaws.com/subud/8627127801.pdf
    • https://uploads.strikinglycdn.com/files/7fc86943-7027-4924-9ac6-918a570f71fb/80799647059.pdf
    • https://s3.amazonaws.com/jolufozo/batman_a_death_in_the_family_movie.pdf
    • https://s3.amazonaws.com/gavexilatuvitaz/31461617066.pdf
    • https://uploads.strikinglycdn.com/files/1e695c83-cf69-4ad3-9ef8-2af299f34ede/4855591647.pdf
    • https://s3.amazonaws.com/vatosolikijike/dcuo_new_styles_list.pdf
    • https://uploads.strikinglycdn.com/files/57ddaa3f-7f49-429b-b07e-255b4910cd96/34697915100.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000a932.bin
2ec32f5a50eec9e015abe305db824fc964ee6e1b42b1b12644023989b7af6ece		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA932 5728 bytes
font_01_sfnt_off0000bc96.bin
01ed0ad12cb1aec39fdd7bbd52a257d9018b9ef561fc839711269bf4864c2288		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBC96 9328 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.