Malicious PDF — malware analysis report

Static analysis result for SHA-256 368158349a3d3f8b…

MALICIOUS

PDF

85.1 KB Created: 2021-03-05 02:06:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-17
MD5: 029f8a10b37a217acbd5474962917531 SHA-1: ffebecdc985c8156ba095aa0a270edf9d6d468aa SHA-256: 368158349a3d3f8b3c8ddc6ba4ae60616c020d6ba4378c0b80779a5523768478
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating the presence of external URIs and is flagged by a machine learning classifier as malicious. The document body, though heavily obfuscated, contains text related to a "money challenge" and the primary malicious URL is associated with this lure. The presence of embedded URLs suggests an attempt to redirect the user to a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/123?utm_term=26+week+money+challenge+%252410000+pdf PDF link annotation
    • https://cdn.sqhk.co/feketukadoz/crfgjij/wamotuvigo.pdfIn PDF document text
    • http://wewogokuwidu.mywebcommunity.org/sefugojevixegazuxofiwexo.pdfIn PDF document text
    • https://cdn.sqhk.co/nerenina/hi0hege/download_choice_of_the_ninja_mod_apk.pdfIn PDF document text
    • http://toxaxugepevu.iblogger.org/dudumuwopixesam.pdfIn PDF document text
    • http://jikusofare.mywebcommunity.org/70966146709.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/nigimul/log_table_ncert.pdfIn PDF document text
    • https://s3.amazonaws.com/futamo/harga_agya_trd_2014_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/wizidimawag/can_you_reheat_cooked_pasta_in_microwave.pdfIn PDF document text
    • https://s3.amazonaws.com/zisulamisozoto/chal_ve_tu_bandeya_mp4.pdfIn PDF document text
    • https://s3.amazonaws.com/jivala/doruma.pdfIn PDF document text
    • http://jagogapibibolin.epizy.com/pilozolamoxu.pdfIn PDF document text
    • https://s3.amazonaws.com/kegubinefuda/whats_the_zip_code_of_my_current_location.pdfIn PDF document text
    • https://s3.amazonaws.com/davawina/rawatizirupegi.pdfIn PDF document text
    • http://zevesijuduma.atwebpages.com/77819610820.pdfIn PDF document text
    • https://s3.amazonaws.com/zafirawit/bulk_powders_informed_whey_review.pdfIn PDF document text
    • https://s3.amazonaws.com/mejigavukolu/tableau_tutorial_videos_youtube.pdfIn PDF document text
    • https://s3.amazonaws.com/gavexilatuvitaz/brahms_hungarian_dance_5_piano_sheet.pdfIn PDF document text
    • http://jejopufopox.rf.gd/english_speaking_sentences_in_daily_life_free_download.pdfIn PDF document text
    • https://s3.amazonaws.com/gajakelegeza/top_10_foods_to_eat_to_lose_weight_fast_way.pdfIn PDF document text
    • http://sunivope.rf.gd/pojozozetizelizozajuvoza.pdfIn PDF document text
    • http://sixategajufob.epizy.com/curriculum_development_book_by_purita_bilbao.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f689.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF689 3016 bytes
SHA-256: c1f534ecf19ab5dd4bec074efddcd333317b946cb3e436f9fe0d70ebaa567560
font_01_sfnt_off00010143.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10143 6176 bytes
SHA-256: 8ccb072b5dd5f69d496995269af67da914affd276971cf4b1c1dc4640973ecaf
font_02_sfnt_off0001164e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1164E 1936 bytes
SHA-256: cf50d13c5c21d2e34fba0d9dd21119d4839fc35fdaebfe62cbacf51850cc328d
font_03_sfnt_off00011f8d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11F8D 11272 bytes
SHA-256: 009c7e0c45d958337c08a1e6fd094d5ccdcff8dfcb7291c2acdfe0ea721e4a6a

Open this report in the interactive analyzer, or submit your own file for analysis.