Malicious PDF — malware analysis report

Static analysis result for SHA-256 38bd6534cd5c1948…

MALICIOUS

PDF

105.5 KB Created: 2021-03-22 21:10:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d34607dfd9ead9a657d8f0f66cdeb362 SHA-1: ab2c0d0acea96377dae0a8498fb77ac18825ad78 SHA-256: 38bd6534cd5c1948c14615cac7b9b2badb185def75ec54430c045f4de054dc5a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to a suspicious domain, likely intended to trick the user into downloading further malware or visiting a phishing site. The document body is heavily obfuscated, preventing a clear understanding of its specific content, but the presence of the external URI strongly suggests a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/wix?keyword=goalrilla+gs54c+installation+manual
    • http://lazirawolewok.getenjoyment.net/jutuguwezulidades.pdf
    • https://cdn-cms.f-static.net/uploads/4388181/normal_6038063b9948e.pdf
    • https://muverope.weebly.com/uploads/1/3/0/7/130776407/puvajadiwu_lewakamumuwaki.pdf
    • https://static.s123-cdn-static.com/uploads/4409797/normal_5fc829f283f7b.pdf
    • https://wazolupagod.weebly.com/uploads/1/3/0/7/130775763/1056013.pdf
    • https://cdn-cms.f-static.net/uploads/4486550/normal_5fd772a76da31.pdf
    • https://static.s123-cdn-static.com/uploads/4496582/normal_5ff971637b0b7.pdf
    • http://rumurel.mywebcommunity.org/the_eyes_of_the_dragon_princess_eng_sub.pdf
    • https://cdn-cms.f-static.net/uploads/4469365/normal_60520f304c95a.pdf
    • https://cdn-cms.f-static.net/uploads/4467038/normal_60298ab3b0ba6.pdf
    • https://cdn-cms.f-static.net/uploads/4386089/normal_5fd1bf00e7aba.pdf
    • http://nugawijuxuv.mywebcommunity.org/wedobegefotomovuvawizobe.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/xufujofaleki/kirby_heroes_in_another_dimension_guide.pdf
    • https://s3.amazonaws.com/jivala/mujetokogoju.pdf
    • https://uploads.strikinglycdn.com/files/01c7154e-0102-422e-8bb5-53e456908baa/mamiya_rb67_pro_digital_back.pdf
    • https://uploads.strikinglycdn.com/files/a19319b9-3695-4ff9-a7f1-cf29433aed26/kozalito.pdf
    • https://uploads.strikinglycdn.com/files/e4502a25-7439-4d8b-8da1-37ee6441dfbb/volovabogalonoputodu.pdf
    • https://s3.amazonaws.com/falufusu/simafavite.pdf
    • https://uploads.strikinglycdn.com/files/87afd747-d0f8-4247-9e11-9f7deb1b04e3/vesububare.pdf
    • https://uploads.strikinglycdn.com/files/c8c1b156-2e9e-43a8-a226-a5232533563f/7402265295.pdf
    • https://s3.amazonaws.com/midizaxopazeji/tuzobagev.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012dbc.bin
71755ba89c401f5d83b38488892ba0fe61cff03ed2b47fae34d8eaf97cd7c28b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12DBC 5124 bytes
font_01_sfnt_off00013f12.bin
5b69ff43e55f98130482f5a5df69354fad4b2c89645734c99053117c964b7dee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13F12 2600 bytes
font_02_sfnt_off00014a7a.bin
bc868878d4926f330cc0e75339aac6575092cd7bd5c976a10c4e2be737ef081f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14A7A 11484 bytes
font_03_sfnt_off000171d4.bin
629b27ab8197ff361adc68b19e2f9e087d387f4aeab4740dfbf9a8d9d57fcd50		 pdf-font-stream PDF embedded font (sfnt) at offset 0x171D4 16548 bytes
font_04_sfnt_off00018830.bin
1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18830 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.