Malicious PDF — malware analysis report

Static analysis result for SHA-256 36833e0171a8f104…

MALICIOUS

PDF

79.3 KB Created: 2021-03-27 20:07:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0f33143fda9f20a99fd1a5f3307fc356 SHA-1: b65cfe9d6f4f1b9d56bc0a2c3e243d53f82bf6a9 SHA-256: 36833e0171a8f104362a8c0a8b6c510e8b0ead2f4e7679d7ca2a3829c7a63247
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, suggesting it's a lure for malicious content. ClamAV detection and ML classification strongly indicate malicious intent, likely a phishing attempt disguised as a magazine PDF. While no scripts were explicitly extracted, the PDF structure and embedded URI are indicative of a downloader or phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/award?keyword=canal+boat+magazine+pdf
    • https://cdn.sqhk.co/karadirimose/mqjdGLj/derailed_movie_2005.pdf
    • http://rosativiwam.mypressonline.com/roloxasexu.pdf
    • https://cdn.sqhk.co/bifoligi/hjgNnjj/fuziwivupokufonefexiz.pdf
    • https://lerekisisag.weebly.com/uploads/1/3/1/4/131408666/jifujusarupo-dubopikatif-ruluvuxewu-namolatu.pdf
    • https://nobasaxekomu.weebly.com/uploads/1/3/5/3/135322761/rubedu.pdf
    • https://rudunusom.weebly.com/uploads/1/3/4/6/134602981/4577960.pdf
    • http://fezelegafefuv.mywebcommunity.org/jivakafi.pdf
    • https://banafazag.weebly.com/uploads/1/3/4/3/134325205/bonifi.pdf
    • https://cdn.sqhk.co/malevevipali/jYtvCib/didezabaganixofugarodok.pdf
    • https://nabidojanafo.weebly.com/uploads/1/3/4/4/134455463/rovibamamiroka.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/2239fd26-09dc-4f6e-8d70-427aaa0b6f2e/java_8_in_action_lambdas_streams_and_functional-style_programming_manning_2014.pdf
    • https://uploads.strikinglycdn.com/files/22c08574-a52d-4182-9476-4a567c8f24d9/mejuposi.pdf
    • https://uploads.strikinglycdn.com/files/577a9f07-92af-4743-98e7-907787188cfa/how_to_reset_2gig_gc2.pdf
    • https://uploads.strikinglycdn.com/files/8b9d78d4-124a-41b2-95db-2dc6a5ed9a40/pathfinder_ultimate_combat.pdf
    • https://989244f3-426d-4557-b4f1-0018dac9047c.filesusr.com/ugd/57c819_e2093c6cbe8e4e8e902e4e5ff57c64bc.pdf?index=true
    • https://30de3caf-c510-4ce9-8691-b8280dc60d9b.filesusr.com/ugd/4980ee_cd667ba0ee0c4153b72848e1256e1432.pdf?index=true
    • https://uploads.strikinglycdn.com/files/6f113917-0907-4536-9a2d-f37c77b1a7b8/71679688701.pdf
    • https://uploads.strikinglycdn.com/files/e29a430e-a203-4016-8662-2afc0fc4db6e/fijagew.pdf
    • https://uploads.strikinglycdn.com/files/5a7bedce-01c5-4856-bed6-7f6c3427a952/wokorixejesugikap.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fa87.bin
eb51824b23c6782d24865b31663db86ad28c346216cb759c100b7d8f5f5553d8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA87 5184 bytes
font_01_sfnt_off00010c20.bin
e6f1f3ca70c5277f5cf07413b58f6db972a1672f3b400ad3744f667b89e28e05		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10C20 10624 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.