Malicious PDF — malware analysis report

Static analysis result for SHA-256 356577c150ba6d1e…

MALICIOUS

PDF

76.3 KB Created: 2021-03-17 11:41:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 58f03e39d1f3f51c50001218769aeabe SHA-1: 5f0a8fa1577fbdec6623f10a1ff55df666f15a1d SHA-256: 356577c150ba6d1e2795f8875c5e6898fdf99d233733e90214fb268fee740222
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. The document body, though heavily obfuscated, appears to be a lure related to training workshops. No scripts were extracted from this sample, but the presence of malicious URLs and the overall detection profile strongly suggest a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=dbt+training+workshops+2019+online
    • http://idslim-italia.site/74618872998xa0z.pdf
    • http://daliadiago.com/5324010966660hbe.pdf
    • http://alex-travel.moscow/jinejuzotwbs0r.pdf
    • http://kuxufijum.iblogger.org/posojuxodunutixupedugowa.pdf
    • http://smartbright.club/irobot_roomba_i6_6550_robot_vacuum_with_automaticsyotz.pdf
    • https://cdn.sqhk.co/tagodepa/gijgWJk/38027950002.pdf
    • http://vumilopevakidom.iblogger.org/is_forged_in_fire_on_netflix_uk.pdf
    • http://submonster.xyz/better_informed_meaningiob9p.pdf
    • http://creditinquiry.info/92338477219a7qnk.pdf
    • http://tryporte.xyz/onkyo_tx-nr636_4k_60hz3bqit.pdf
    • http://reduslimitaly.website/lagu_waiting_for_you_unlike_pluto6c6u5.pdf
    • https://cdn.sqhk.co/numokafas/ii9hgfF/moporaf.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://mibawojerasubuw.rf.gd/how_to_use_commas_with_prepositional_phrases.pdf
    • https://uploads.strikinglycdn.com/files/a4cca510-1bf6-4807-b3d9-a4b52b5f4299/26480591526.pdf
    • https://uploads.strikinglycdn.com/files/a04b71d1-9a77-4363-9b91-3cc817fcdaa5/vevujofej.pdf
    • https://3dbd840c-7861-42b4-b064-af52d1d2f4eb.filesusr.com/ugd/86319b_4a8ab2dcbed642168d68e947a1f9fa51.pdf?index=true
    • https://3568ea06-17fa-4787-91ae-86b9aa918cbd.filesusr.com/ugd/8ade13_303a353e1651442f8d725f1edb63c4dd.pdf?index=true
    • https://uploads.strikinglycdn.com/files/0acd0741-47bf-473e-9fee-51622d98dba0/what_do_teenager_do_for_fun.pdf
    • https://6a1e2a5f-c456-4288-b9d5-5378f87870fb.filesusr.com/ugd/076fac_3ff83778a9214a52b3da6bba52112809.pdf?index=true
    • https://7f1888b6-cdab-4603-9914-1cf81a8b29aa.filesusr.com/ugd/6846fe_50dc99660905484986323a076c2a8777.pdf?index=true
    • https://835a0401-7144-467e-aacc-710587930ffc.filesusr.com/ugd/432cba_74fee7e8b15a40fabc65e6831fa9b71a.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb99.bin
97492295bf2d9834a59585e51b83096ae9a27cba0bda3c1bcb6154458e1c8ef4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB99 5860 bytes
font_01_sfnt_off0000ff9a.bin
dd7e4773266578f052323d7104d0f1a20e018754770d44f84d3532f27ba7be35		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF9A 10648 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.