Malicious PDF — malware analysis report

Static analysis result for SHA-256 34d80a9428de7c79…

MALICIOUS

PDF

73.5 KB Created: 2021-04-01 02:53:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: d45ebbb6abc263440af587598303c6ca SHA-1: edac3d54ef70334974c5733d7baf669ae8c3ddf6 SHA-256: 34d80a9428de7c799db343d2e56cde1c26bc5913e1266be21433b8e5dfc2d601
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URI pointing to a malicious domain, identified by both heuristics and ClamAV. The document body, though heavily obfuscated, suggests a lure related to 'ISO 22000 training course' to entice users to click the embedded link. The presence of external URIs and the ML classifier's high confidence score indicate malicious intent, likely to redirect users to a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=iso+22000+training+course PDF link annotation
    • https://cdn.sqhk.co/gobajejuz/bifZyt1/pubamavusejexejirexad.pdfIn PDF document text
    • https://cdn.sqhk.co/kofuvufexo/fgiTpYo/dejulexobekagurizirexano.pdfIn PDF document text
    • https://cdn.sqhk.co/zimuteraf/gddiaNi/rollercoaster_mania_mod_unlimited.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4470533/normal_60551c5b65dd0.pdfIn PDF document text
    • https://cdn.sqhk.co/fajixojemom/jUrhagi/kodokiwakodikidido.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476564/normal_603174ceeb5f2.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4492593/normal_5fde8c638005e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4377114/normal_60120fdec83ee.pdfIn PDF document text
    • https://cdn.sqhk.co/jifexekezeli/huifja0/sikebemeka.pdfIn PDF document text
    • https://cdn.sqhk.co/vanewano/jeETvji/41074154936.pdfIn PDF document text
    • https://cdn.sqhk.co/vadavenaw/qcDgiij/bovodabudeles.pdfIn PDF document text
    • https://cdn.sqhk.co/jeporikate/gjhajjR/netomowogufijapex.pdfIn PDF document text
    • https://cdn.sqhk.co/dijabidasu/aKjbhfm/anime_manga_amino_for_otakus_apk.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381536/normal_6034223dabaa0.pdfIn PDF document text
    • https://cdn.sqhk.co/lebudawojafi/jscghgf/ffxv_monster_arena_prizes.pdfIn PDF document text
    • https://cdn.sqhk.co/zatufora/ow0Yydq/26424534938.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4468255/normal_60130f656c1e9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454547/normal_605c4b1d58674.pdfIn PDF document text
    • https://cdn.sqhk.co/fojevimexu/ghNGfU6/ditulojebitudifuzurexa.pdfIn PDF document text
    • https://cdn.sqhk.co/fuwegamuvev/fjjvRic/xewujibasidukufi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486994/normal_6022d0c1c9e8d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421466/normal_60400ac51bde3.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jadudusujuje/77708285892.pdfIn PDF document text
    • https://s3.amazonaws.com/lotibabakuj/95513818088.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e296.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE296 5144 bytes
SHA-256: 2c1757545fdcc7e76372fdacf88d9b30ccb1c4d8c5d6038ce0ab570662a3d5d2
font_01_sfnt_off0000f428.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF428 10244 bytes
SHA-256: 3ad258184b9b71c1482fab8431e7abcd0df885e8d0d71e08882c0e5cd1374d0c

Open this report in the interactive analyzer, or submit your own file for analysis.