Malicious PDF — malware analysis report

Static analysis result for SHA-256 3b29e00b8beee826…

MALICIOUS

PDF

91.9 KB Created: 2021-03-09 19:52:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d74b6b57e197e43dce6fc0b720ad9ccb SHA-1: 22e53d40660824cac0488d4e10f861932a94cf20 SHA-256: 3b29e00b8beee826ef8935bab209f6d2a112b5205d8a4148cc45bc92a59a988b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to host or redirect to a malicious payload. The document body, though heavily obfuscated, suggests a lure related to 'industrial biochemistry books pdf', aligning with a phishing or social engineering pretext.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/123?utm_term=industrial+biochemistry+books+pdf
    • https://static.s123-cdn-static.com/uploads/4393644/normal_5fc9e1df3e5e6.pdf
    • https://cdn-cms.f-static.net/uploads/4381289/normal_60370d40a94eb.pdf
    • https://static.s123-cdn-static.com/uploads/4459796/normal_5ffd05dd1aa10.pdf
    • https://cdn.sqhk.co/batovafakupo/jidGVwu/rebel_racing_mod_apk_unlimited_money_android.pdf
    • https://cdn.sqhk.co/wubofuse/rVhiii0/ditirubugasizu.pdf
    • https://static.s123-cdn-static.com/uploads/4417675/normal_5fffe7f4d92af.pdf
    • https://cdn.sqhk.co/netesatova/aid6ihV/53810764995.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/a8139783-5bf2-404f-b23d-911a6bc8eb14/how_much_does_geotech_cost.pdf
    • https://s3.amazonaws.com/resisuna/74406991055.pdf
    • https://uploads.strikinglycdn.com/files/67bc68d8-97df-44ae-a3e1-63846789dc62/authors_purpose_worksheet_6.pdf
    • https://uploads.strikinglycdn.com/files/3172dddf-cd17-4e34-9024-ad3a606cf0bd/sozisetifejugaxetoforufex.pdf
    • https://uploads.strikinglycdn.com/files/0a536bf5-2295-4424-ab2a-3cbad7b12916/woxomexuwutemajitisig.pdf
    • https://s3.amazonaws.com/farezelof/49902608660.pdf
    • https://uploads.strikinglycdn.com/files/2ec32f48-e135-4812-abe3-7bebab59f006/75299233086.pdf
    • https://uploads.strikinglycdn.com/files/9410a5cc-9436-4d39-9f40-69eb2d647149/3434921957.pdf
    • https://uploads.strikinglycdn.com/files/d2bc4ad9-dbb0-458f-a29b-c2a6d1ac7550/21721894615.pdf
    • https://uploads.strikinglycdn.com/files/0580b16d-2e4c-464c-abfa-288ca324405e/28120184632.pdf
    • https://uploads.strikinglycdn.com/files/1307d000-fb84-4dfc-afb8-f5c4a83656ad/dopilujuzonaw.pdf
    • https://uploads.strikinglycdn.com/files/317a5cba-b70c-4208-b05d-87f0115da601/kanemekemodalinem.pdf
    • https://uploads.strikinglycdn.com/files/3c32df68-f4d5-4124-a279-4eb2598e1b77/how_to_make_a_rounded_corner_triangle_in_photoshop.pdf
    • https://uploads.strikinglycdn.com/files/47da40bf-3115-4e20-add1-9314e11bb957/dirt_devil_easy_lite_canister_manual.pdf
    • https://uploads.strikinglycdn.com/files/5119867c-c837-48f1-afbb-9bb3a73e23cf/mexop.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000116e8.bin
ffeb89eaad713c9717385028f79c9757067aafb2c2382ea8cbab0e6efe35a425
pdf-font-stream PDF embedded font (sfnt) at offset 0x116E8 6744 bytes
font_01_sfnt_off000127d0.bin
baab56306f9b2c47f96e9e49b6b266000372e01b2a1793fd4c4eb181610a1385
pdf-font-stream PDF embedded font (sfnt) at offset 0x127D0 5636 bytes
font_02_sfnt_off00013ad1.bin
79b5aa75f51a083aa047eff786a6b38878a6bc789261e3cc8822e91d8e58a2ee
pdf-font-stream PDF embedded font (sfnt) at offset 0x13AD1 10944 bytes