Malicious PDF — malware analysis report

Static analysis result for SHA-256 3c92530e9d951e73…

MALICIOUS

PDF

77.0 KB Created: 2021-03-16 02:19:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0b43479b12f71815942fe93407d4eb04 SHA-1: 2c25139430706a5d4b1ca152236fee64406078b6 SHA-256: 3c92530e9d951e730e911883130dfff23561251793a331d29a609333a8a4ec38
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. The presence of an external URI pointing to 'pelibifir.ru' suggests a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a common phishing lure, likely designed to trick users into downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=how+to+reply+thanks+for+appreciation+mail
    • http://fasad-dom.site/nezanoxonovubitg9e7.pdf
    • http://vezerfa.xyz/tecnicas_de_redaccion_y_ortografia9qgrh.pdf
    • http://kimokabif.medianewsonline.com/how_to_know_sentence_structure.pdf
    • http://moymagazin.xyz/womogodilagaxepujadakyk8d0.pdf
    • http://storeplus.pro/how_to_make_power_pressure_cooker_xlmdpdm.pdf
    • http://onkoprofi.ru/wenutadijetve8z.pdf
    • http://fito4ka.xyz/munaranekeviwixojusaragukyj3k.pdf
    • https://cdn.sqhk.co/madagijoj/iiygicf/72201195409.pdf
    • http://lordtrans.ru/royal_mail_international_tracked_postage_costs36daz.pdf
    • https://cdn-cms.f-static.net/uploads/4445866/normal_602ed73fcb8e4.pdf
    • https://cdn.sqhk.co/toledexipez/Riehcgg/zutanazafijiwupot.pdf
    • https://cdn.sqhk.co/lomasamube/jfijhg0/tubby_todd_aoo_reviews.pdf
    • http://kiwenalod.medianewsonline.com/how_to_treat_cystic_acne_fast.pdf
    • http://drive4mclanemilwaukee.com/adjectives_vs_adverbs_worksheet84aom.pdf
    • https://static.s123-cdn-static.com/uploads/4411686/normal_6005b2ed43bbc.pdf
    • https://cdn-cms.f-static.net/uploads/4452374/normal_6026da9148a2b.pdf
    • http://vkrowl.com/how_to_shut_off_water_softeneryd6yw.pdf
    • http://sugameloxufe.mywebcommunity.org/tatazenujibe.pdf
    • https://cdn.sqhk.co/guwuweri/VjhoJI7/translate_portuguese_to_spanish.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://b2fc43c4-60ab-4dc1-a1c8-84833fda4e2a.filesusr.com/ugd/37321e_7efb2b98faaf4288b2c75a9350554fb0.pdf?index=true
    • https://72b50e20-f79f-40ca-96b4-24bef83e308f.filesusr.com/ugd/1a1092_35a0b30ce2704137916814cfa92fbc8c.pdf?index=true
    • https://e05653fc-386e-4c8b-889d-738aee72c63e.filesusr.com/ugd/62421a_47a950447910414f97c418183cb2b97d.pdf?index=true
    • https://d115d978-d96a-40c8-9764-5d959708fc35.filesusr.com/ugd/436160_a32b5265e8594b21a620ceb74d4ae934.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee5f.bin
e3b8b53deec1ecfa9e58344c1948de56195a98f600888a07b862aff9a05dfc33		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE5F 5476 bytes
font_01_sfnt_off000100e9.bin
1321b0969f1185e8bb35ef0e0df0c85af134bcd31dc6b0d1942facca2afa9f8e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100E9 11008 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.