Malicious PDF — malware analysis report

Static analysis result for SHA-256 371ac4d69f5a12c7…

MALICIOUS

PDF

87.4 KB Created: 2021-06-03 10:58:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 02f5ff3dee2ddc1573e76e2120634eff SHA-1: d4ecc9571f6e24aea4c85bad9c8a5d2efb10f15d SHA-256: 371ac4d69f5a12c76c21f2a26744be3136cfda930d88cabc3e3b1f78a940780a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, appears to contain metadata related to a product, suggesting a lure to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pixomot.ru/pbw?utm_term=bottom+loading+water+dispenser+with+ice+maker
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/41772144-332c-44b5-bbd0-835be43a0b3e/what_does_the_book_of_life_mean.pdf
    • https://uploads.strikinglycdn.com/files/ad638f5f-9ed7-44d3-92cb-8bb1e0ba65e4/90077678282.pdf
    • https://uploads.strikinglycdn.com/files/7acd61fd-dde2-41bb-8054-19b439e09224/microsoft_office_2018_free_download_full_version_for_windows_10_with_crack.pdf
    • https://uploads.strikinglycdn.com/files/ce70a919-ee98-456c-9162-8aa387ee0ead/autotune_evo_vst_fl_studio_20.pdf
    • https://uploads.strikinglycdn.com/files/8f27cfe5-6ae4-4fec-b608-5b9051e3f994/48714518984.pdf
    • https://uploads.strikinglycdn.com/files/17c4f9c7-205d-46c8-b4d1-7c69f533fc62/roman_breviary_for_sale.pdf
    • http://rugewenuzed.pbworks.com/w/file/fetch/144426783/english_grammar_test_paper.pdf
    • https://uploads.strikinglycdn.com/files/92ce5484-410b-4f3f-8761-f05c6fa1cdd6/what_is_inferential_comprehension.pdf
    • https://uploads.strikinglycdn.com/files/fe481ad8-0417-46f0-9aff-8e9fe99c855e/40687223475.pdf
    • https://uploads.strikinglycdn.com/files/7f734ec1-7101-4a29-8cbc-d1de9f78731a/fallout_4_map_bobblehead_locations.pdf
    • https://uploads.strikinglycdn.com/files/b6185568-5d11-4647-b89f-307542a88ded/how_many_calories_in_taco_bell_breakfast_quesadilla.pdf
    • https://uploads.strikinglycdn.com/files/f0f6e760-1ca8-4b65-bb47-5edb6ca36a1d/99533317483.pdf
    • https://uploads.strikinglycdn.com/files/cba67151-d66b-46a5-a1de-31e9e4bd2451/hunchback_of_notre_dame_songs_frollo.pdf
    • https://uploads.strikinglycdn.com/files/c15e2d7a-aa4f-44d5-911b-0ba4edf37042/how_to_change_the_heating_element_in_a_speed_queen_dryer.pdf
    • https://uploads.strikinglycdn.com/files/88c3b493-41fe-4917-8728-04a86a421ece/38593117441.pdf
    • https://uploads.strikinglycdn.com/files/58de3850-508f-4150-83f4-15c934bdb35e/529215194.pdf
    • https://uploads.strikinglycdn.com/files/26320276-e019-48f2-bd3e-16a12f47fd21/wowasoxovinivapawixube.pdf
    • https://uploads.strikinglycdn.com/files/fb2c9af1-6960-4dd3-bda2-8fc597e3ec5f/32699522404.pdf
    • https://uploads.strikinglycdn.com/files/0d570512-0cf4-4291-a1b6-6fa3d2edd16a/shadow_fight_2_special_edition_hack_version_mod_apk.pdf
    • https://uploads.strikinglycdn.com/files/5df363f5-46b9-4850-aa7a-dd06bf141fa5/58118343329.pdf
    • http://sofutikajen.pbworks.com/w/file/fetch/144455598/how_to_put_reference_on_capitec_app.pdf
    • https://uploads.strikinglycdn.com/files/63f42c77-06d1-40f0-87df-140e22c19f3f/truyn_kiu_chuyn_th_thnh_phim.pdf
    • https://uploads.strikinglycdn.com/files/9a63196a-d343-4a42-9f0a-e9ceaa61c594/zabidebufosinunoguwe.pdf
    • https://uploads.strikinglycdn.com/files/4cc86c38-d49d-4359-835c-cceaad430fdf/gaworubo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011369.bin
4b5dfa826b7d743728ba680d9e7a8994840d7d56690f7baf58d27f817473d678		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11369 5692 bytes
font_01_sfnt_off000126af.bin
14d63d5fba5655b98190886c14bb7c8b3c43a37d504c6ff68ac5e634245caa64		 pdf-font-stream PDF embedded font (sfnt) at offset 0x126AF 11904 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.