Malicious PDF — malware analysis report

Static analysis result for SHA-256 355253e20963bfe5…

MALICIOUS

PDF

216.8 KB Created: 2021-03-16 03:57:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-17
MD5: f023fa0a61cfed2e1e18dfdbc0e6799f SHA-1: 051e71ae48498023a9999cd06a11f2cf8d47072e SHA-256: 355253e20963bfe50ca3ae57dd0eebb10d5138a0efb3bf5b80c5d6794aad30be
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, which is likely used to host a malicious payload or redirect to a phishing site. The document body, though heavily obfuscated, suggests a lure related to song lyrics, aiming to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9910

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=memories+bring+back+memories+new+song+lyrics PDF link annotation
    • https://cdn.sqhk.co/pazaxefuma/cgPhihh/netflix_series_about_chess_player.pdfIn PDF document text
    • http://talemine.getenjoyment.net/piwuzafiragomapewajujo.pdfIn PDF document text
    • http://porizaritofo.mypressonline.com/advertising_campaign_strategy_5th_edition.pdfIn PDF document text
    • https://cdn.sqhk.co/rotexopapi/ipEIbgi/border_patrol_agent_application.pdfIn PDF document text
    • http://nupesupo.mypressonline.com/2016_honda_civic_service_reset.pdfIn PDF document text
    • https://cdn.sqhk.co/movijomo/dhhQEgh/rock_climbing_gym_gilbert_az.pdfIn PDF document text
    • http://tupaxeguna.scienceontheweb.net/is_the_schwinn_sidewinder_a_good_bike.pdfIn PDF document text
    • https://cdn.sqhk.co/linewebozid/3hbU5hg/aceableagent_texas_real_estate_license.pdfIn PDF document text
    • https://cdn.sqhk.co/zumumolebajo/KeXjcid/psx4_droid_pro_apk.pdfIn PDF document text
    • https://cdn.sqhk.co/gilitejeku/hhgDbjb/cross_fight_b-_daman_episode_1.pdfIn PDF document text
    • https://cdn.sqhk.co/xaselavub/igSMthc/tetafuwikedon.pdfIn PDF document text
    • https://cdn.sqhk.co/daborofus/ihihdjj/49128424385.pdfIn PDF document text
    • http://botojagi.iblogger.org/littlest_pet_shop_guide.pdfIn PDF document text
    • http://jibakerutev.mypressonline.com/procalcitonina_pediatria.pdfIn PDF document text
    • https://cdn.sqhk.co/ronelejibir/EybqhaC/motor_vehicle_near_me_pa.pdfIn PDF document text
    • http://rijigikesezaga.mypressonline.com/jojamapitawosezel.pdfIn PDF document text
    • https://cdn.sqhk.co/rurokusulos/czAihay/ganenekibimedufukiroz.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://tifilumiteva.epizy.com/cause_and_effect_worksheets_for_5th_graders.pdfIn PDF document text
    • http://rebukupomapet.rf.gd/venego.pdfIn PDF document text
    • http://lesidiwajenowil.myartsonline.com/dufakol.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fcf07243-2f0a-446f-a7c7-8f67a3ade820/un_tranvia_llamado_deseo_trailer_espaol.pdfIn PDF document text
    • http://mutodilevo.epizy.com/88499875078.pdfIn PDF document text
    • http://badamowafe.onlinewebshop.net/max_lucado_books_amazon.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dafc20e5-35db-4b1e-96c8-1dd2326a0c9c/beats_studio_headphones_not_charging.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/828385da-8576-4510-9996-836417d0ef09/does_your_face_get_flushed_in_early_pregnancy.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1d5cff73-f1da-405d-aee9-c45fe6b60f80/how_do_you_turn_on_a_jam_zero_chill_speaker.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e4d4a3f5-f9dc-4c0e-8211-4e7aa5e01da9/funosapazezifisoral.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00031b9e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x31B9E 5520 bytes
SHA-256: ae6f08fda33637a7fd28d9baf52bcf86d3c1a60385407b038f9fd7f79aac808a
font_01_sfnt_off00032e77.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x32E77 11204 bytes
SHA-256: 8aeb8d549a2565d22ddb8169040cd67fdfc6e57bdce234b2c03631b719d18370

Open this report in the interactive analyzer, or submit your own file for analysis.