Malicious PDF — malware analysis report

Static analysis result for SHA-256 346153a8833adae0…

MALICIOUS

PDF

85.0 KB Created: 2021-03-18 07:16:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 401beb6fec81ca23964859a7d62687c7 SHA-1: caadbc049520745e7bef6f5f1bf5aebf98b8b3e7 SHA-256: 346153a8833adae0a5743abb54c731a81cba511829252486aa69eb4aea52261c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely intended to redirect the user to a malicious site or download further payloads. The document body, though heavily obfuscated, suggests a lure related to 'cancer de pulmon' (lung cancer).

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=cancer+de+pulmon+pdf+definicion PDF link annotation
    • http://fodefon.getenjoyment.net/simbiosis_biologia.pdfIn PDF document text
    • http://wukilirukorobow.iblogger.org/what_is_multivariate_analysis_in_research.pdfIn PDF document text
    • http://fagilef.getenjoyment.net/allahabad_university_holiday_list_2020_20.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4373987/normal_5fee2a372a131.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421199/normal_6052b7d8d30fd.pdfIn PDF document text
    • http://fazejajogavu.medianewsonline.com/best_pll_algorithms.pdfIn PDF document text
    • http://lulezuzebat.22web.org/litakifelaluzisevemodumog.pdfIn PDF document text
    • http://nabavawuzafurur.mygamesonline.org/what_is_the_importance_of_critical_thinking_reading_and_writing.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4490534/normal_600d8cd67415e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://650c977b-0274-48a2-8498-43c0efc39f4e.filesusr.com/ugd/dbad32_4ae989ab6ae0464da75f8251f2f588ef.pdf?index=trueIn PDF document text
    • https://425e2ee7-996f-4c6d-a593-b44a2a39b733.filesusr.com/ugd/bb05c1_241a821c250e4dd8b7bfa857b7967716.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vixuwogetiv/uc_browser_vpn_apk_pure.pdfIn PDF document text
    • https://s3.amazonaws.com/palevijuj/blue_planet_3rd_edition.pdfIn PDF document text
    • http://xologikaju.atwebpages.com/broadcast_media_meaning.pdfIn PDF document text
    • http://vatonafikokex.atwebpages.com/abecedaire_francais.pdfIn PDF document text
    • https://ee897e78-a157-4eb5-8a47-d615096087a2.filesusr.com/ugd/113e89_3c4b3366dff94dfea3ab8414be841a11.pdf?index=trueIn PDF document text
    • https://9a1eab6f-da2d-4a41-99bb-18a59f11b130.filesusr.com/ugd/c2b690_b17da1f190fd4b2391423eb21651a171.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wipotegadodorek/52277964122.pdfIn PDF document text
    • https://s3.amazonaws.com/nakuzafol/spotify_premium_free_apk_july_2018.pdfIn PDF document text
    • https://s3.amazonaws.com/xezonijida/business_english_video_lessons_free.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010e76.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10E76 5028 bytes
SHA-256: 2e6f833b82da20f34c107a79c0aa1c4b745b0a43661c82307289a2849572b033
font_01_sfnt_off00011f7c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11F7C 11640 bytes
SHA-256: 3ae23d778cc29b319f08681e25547df388b75665ab20dc47bda055f2977b4f54

Open this report in the interactive analyzer, or submit your own file for analysis.