Malicious PDF — malware analysis report

Static analysis result for SHA-256 35b35bf8a4b60b48…

MALICIOUS

PDF

82.6 KB Created: 2021-03-13 18:14:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0e17753c3a65a0102e45f52f9f1a7da4 SHA-1: e4032cfe44621e6d77cb3ad03c81260544d5ba20 SHA-256: 35b35bf8a4b60b481828f4d5c84b69f3d4e9a68f9ddc4f6f219ae6214e55f6e5
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is classified as malicious by ML and ClamAV, and contains an external URI pointing to a suspicious domain. The document body, though heavily obfuscated, contains text that appears to be a lure related to 'isoterm adsorpsi pdf'. The presence of embedded URLs and the nature of the ClamAV detection suggest a phishing or trojan distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9919

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=isoterm+adsorpsi+pdf
    • http://tetupamino.mywebcommunity.org/56304329546.pdf
    • http://3-bureaureport.info/betomaliro2izsh.pdf
    • https://cdn-cms.f-static.net/uploads/4387424/normal_60155ae2d79f9.pdf
    • https://javufivupa.weebly.com/uploads/1/3/4/3/134349262/luvowegal_bozumixawora_dorevozud.pdf
    • http://iranianvc.com/inverse_trigonometric_functions_worksheet_class_1274kxa.pdf
    • https://cdn-cms.f-static.net/uploads/4490250/normal_60241d6907251.pdf
    • http://safijejog.mygamesonline.org/anatole_france_penguin_island.pdf
    • http://fakts.design/44175483644hgiio.pdf
    • http://agent-ritual495.online/widukipezaxagomemorenazinrt.pdf
    • http://kupivse.xyz/syma_rc_helicopter_reviewr6g0y.pdf
    • http://dokukuke.mypressonline.com/xiromafumexejenow.pdf
    • https://gimoxawoja.weebly.com/uploads/1/3/1/3/131380550/a70a8c.pdf
    • https://nexudusuje.weebly.com/uploads/1/3/0/7/130740550/nipurubezokeve_xevogavijo_sewavim_bagor.pdf
    • http://tozaworewinox.mywebcommunity.org/how_to_connect_polk_psw10.pdf
    • https://nopiwevupemaro.weebly.com/uploads/1/3/4/6/134653234/jefufibirelozu.pdf
    • https://cdn-cms.f-static.net/uploads/4381543/normal_60493a3a11ff1.pdf
    • https://bevereka.weebly.com/uploads/1/3/0/7/130739533/2575772.pdf
    • https://cdn-cms.f-static.net/uploads/4476152/normal_5fe748ee3b094.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/60862af3-9d06-4adb-8627-f9ac4c294d9c/nugerokevomotadasef.pdf
    • https://s3.amazonaws.com/tanapilamaxi/life_application_study_bible_nlt_complete.pdf
    • https://uploads.strikinglycdn.com/files/b698e69f-0ce8-44b1-8bff-08842d6017ca/un_grito_desesperado_resumenes_por_capitulos.pdf
    • https://s3.amazonaws.com/ginutu/rifuvodegelane.pdf
    • https://uploads.strikinglycdn.com/files/fc4773f2-5ccc-4159-98ad-62e7efe0bf1e/24430497044.pdf
    • https://s3.amazonaws.com/xopugup/murimakugo.pdf
    • https://uploads.strikinglycdn.com/files/a77145cc-64da-4da4-a386-7bba9eb1cd4a/vupuvabulobujugiwasu.pdf
    • https://uploads.strikinglycdn.com/files/92f289cb-75a3-46cb-8170-7f28fbac45d6/55673727025.pdf
    • https://s3.amazonaws.com/lixuduwonifa/avocent_acs_6048_manual.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e5d3.bin
4c4d92566c5f89adad1da71c13c6abaf3b1d354793058c98ae01f5e09c9f6060		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE5D3 4776 bytes
font_01_sfnt_off0000f605.bin
094d26d6c90e1d5614eb5a8f6c2cd6ffe080b9ace724bf32f74130c6d55cc4c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF605 10160 bytes
font_02_sfnt_off00011916.bin
e93acd332f5893643511f4cefd38969ad5c744ad1b08842a788b6be7d277dd15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11916 16204 bytes
font_03_sfnt_off00012e44.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12E44 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.