Malicious PDF — malware analysis report

Static analysis result for SHA-256 353c64a4d14e9ff7…

MALICIOUS

PDF

77.8 KB Created: 2021-03-25 17:39:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ecc79704cadd876d5ad11d924d7b51c6 SHA-1: ac3b55f70f2848658c0d38e080f8e9aed343e93d SHA-256: 353c64a4d14e9ff75af266931a719217890fcde99d200d0d1d9088438f3883dd
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a link that mimics a search result, likely to trick users into visiting a malicious website. The ML classifier and ClamAV detection strongly indicate malicious intent. Although no scripts were directly extracted, the presence of embedded URLs and the document's deceptive content suggest it's designed to lead users to a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=where+to+buy+french+manicure+guide+strips
    • https://cdn.sqhk.co/nowonipewo/hcYAU1p/lego_marvel_super_heroes_2_ps4_walkthrough.pdf
    • https://cdn.sqhk.co/tagodepa/Uqlgijd/dude_perfect_bowling_trick_shots_2.pdf
    • https://cdn.sqhk.co/lumozupa/fShaV3K/coulomb_s_law_experiment.pdf
    • https://cdn.sqhk.co/vabadoma/oShgT3p/41206185445.pdf
    • https://cdn.sqhk.co/begorukenega/Qg84hb7/asalem_gurthukuradhu_video_song.pdf
    • https://cdn.sqhk.co/tumosirewuw/ja1rias/game_hack_speed_hack_game_free_fire.pdf
    • https://cdn.sqhk.co/novitovikor/RvKjenh/the_hangover_cast.pdf
    • https://cdn.sqhk.co/fogobewataja/big3geI/56907797140.pdf
    • https://cdn.sqhk.co/suxugipajepo/jcTmqIG/5240952502.pdf
    • https://cdn.sqhk.co/ravusigi/dsPhahd/51232519365.pdf
    • https://cdn.sqhk.co/ravusigi/aAgedid/6038192321.pdf
    • https://cdn.sqhk.co/dogilijesiwu/ajgZZme/dance_movies_ballet_hip_hop.pdf
    • https://cdn.sqhk.co/zotevokep/icB1RDg/18664914178.pdf
    • http://pinenud.mygamesonline.org/99061642517.pdf
    • http://nepatokada.mypressonline.com/86254678389.pdf
    • http://vesajob.getenjoyment.net/tica_a_nicmaco_aristteles_livro.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/8bac4862-af34-4870-bca3-970ef42069f3/19087208597.pdf
    • https://uploads.strikinglycdn.com/files/90e3b8eb-8bf1-428a-a031-17a8e6f77dde/mororikiv.pdf
    • https://uploads.strikinglycdn.com/files/5f0e7a9c-7da2-4717-8e5f-8cee5454dd46/what_is_the_formula_for_a_right_angle_triangle_area.pdf
    • https://uploads.strikinglycdn.com/files/44e404fd-179f-4c90-9554-5c457694668f/mefobopefoxedesi.pdf
    • http://mizetum.onlinewebshop.net/budumezutola.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d8a7.bin
07a67373bd2886e52a0d193fecaeda5aeb36506d082eddd13045263d1a32f8a2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD8A7 5792 bytes
font_01_sfnt_off0000ec4f.bin
f73b68ebb6898de41f9c1500a2727e3da4b14cbc552e86716185e75cfeac9c44		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC4F 11340 bytes
font_02_sfnt_off0001123f.bin
a109d5cc1a8599929bd7702a943337bd153faf2776ff4e30ac39a15e38c17cef		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1123F 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.