Malicious PDF — malware analysis report

Static analysis result for SHA-256 3b74257327f69ad4…

MALICIOUS

PDF

88.9 KB Created: 2021-03-28 08:31:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 685e5e12ffe534cf06eb8846f5f6ba8f SHA-1: ba2d48992b91eda051413c7dfb3766f9babf8257 SHA-256: 3b74257327f69ad4e2270a8cbd36fe1eca0463a3ce96a561c0a5ad7f94021551
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains an embedded URI pointing to a malicious domain, likely intended to trick the user into visiting a phishing site. The document body, though heavily obfuscated, contains text related to a product, reinforcing the lure. ClamAV and ML classifiers also flagged this PDF as malicious, indicating a high likelihood of phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/wix?keyword=action+drone+ad-1+price
    • https://vuzaruluweketex.weebly.com/uploads/1/3/4/4/134478477/1545353.pdf
    • http://neojust.ru/98109820580dpt0b.pdf
    • http://nejupike.mygamesonline.org/logitech_g700_spare_parts.pdf
    • http://rawoxaxevog.mygamesonline.org/what_were_the_3_main_ideas_of_the_enlightenment.pdf
    • https://musabonaxuzu.weebly.com/uploads/1/3/2/8/132815830/fogowilikagere_bulixikevugilu.pdf
    • http://viwafuxofiseko.getenjoyment.net/8392206423.pdf
    • http://picsonair.com/valid_void_and_voidable_contract_with_examplesb8a7l.pdf
    • http://prizinsta365.website/how_many_water_molecules_are_in_2.00_liters_of_waterh5r0f.pdf
    • http://changely.club/15297241356gjeps.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://boxulinizisa.epizy.com/texas_buyers_order_bill_sale_form.pdf
    • http://fepapemifen.epizy.com/is_cra_my_account_down.pdf
    • http://kesugonapopuw.epizy.com/banigeredajedafinas.pdf
    • https://s3.amazonaws.com/wofaxil/wejumosupekelosanurofog.pdf
    • http://rokidibamufoduv.epizy.com/banjara_the_truck_driver_movie_480p.pdf
    • http://limoxukuk.atwebpages.com/zalibukuluru.pdf
    • http://golipoximumi.epizy.com/52355933933.pdf
    • http://tedivepi.epizy.com/warm_white_led_christmas_lights_amazon.pdf
    • http://jupegojut.atwebpages.com/71536768048.pdf
    • http://kixurazo.rf.gd/arrl_antenna_book_23rd_edition.pdf
    • http://ramufezumax.rf.gd/wigagokitelawapiper.pdf
    • https://s3.amazonaws.com/dojivewobasuval/mathematics_2nd_year.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000102e9.bin
dad8ebe9cb792b06a058ace3df8748fb16cc7e92550c569b1b2908c7a16c2b62		 pdf-font-stream PDF embedded font (sfnt) at offset 0x102E9 3200 bytes
font_01_sfnt_off00010e54.bin
4aa8306318a6be3914a56ce87870821ff9ba8511a75dba3a955e263e5f9a6479		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E54 4716 bytes
font_02_sfnt_off00011e5c.bin
4ec90f2048b7c4912a6a0bb61041a20e28c2c56281cd140e1925dc9ebf159844		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11E5C 12220 bytes
font_03_sfnt_off000147d8.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x147D8 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.