Malicious PDF — malware analysis report

Static analysis result for SHA-256 40354ad98b08ac1c…

MALICIOUS

PDF

86.3 KB Created: 2021-03-10 20:48:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 058db7b7c56db6bca32bd51fef4f257a SHA-1: 860a633d5125b61072a2df95f180132a4dac034e SHA-256: 40354ad98b08ac1c6f8a52f0eba6924064bf0912be1470aa4b6ec8ccb9a6dd64
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains an embedded URL pointing to 'https://mezovuduw.ru/wix?keyword=period+3+dbq+ap+world+history', which is likely used to redirect the user to a phishing site. The PDF structure and embedded URI heuristic further support this attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=period+3+dbq+ap+world+history PDF link annotation
    • http://zomuregunaradu.iblogger.org/buwutofewajazokizib.pdfIn PDF document text
    • https://cdn.sqhk.co/noperizapewo/haidxTM/car_simulator_2_game.pdfIn PDF document text
    • https://cdn.sqhk.co/xiroxozalal/vHii3gR/karosodulugadigebanizaje.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376127/normal_6041de1b97f99.pdfIn PDF document text
    • https://cdn.sqhk.co/xivomojuf/eTjiZlg/48537117910.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4452852/normal_5fdbe57bc7637.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4459792/normal_5fed99bb45330.pdfIn PDF document text
    • https://cdn.sqhk.co/jilebodetifa/fihy4hi/waxozi.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4369519/normal_5ff10a135d228.pdfIn PDF document text
    • https://cdn.sqhk.co/zexetiminav/beha1hh/download_storybeat_instagram.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/0ed87978-d82e-4a6e-82b6-07fbd6679ade/moto_g6_specs.pdfIn PDF document text
    • http://tubiruk.epizy.com/b_extract_form_rto_maharashtra.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e58d115c-e826-4a94-b5a8-b09d04984247/rojopobejale.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3ec72f82-2570-4571-b46c-55df42d3abb4/how_to_setup_a_home_theater_system_using_the_receiver_as_the_main_control.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fc39c4e5-df2a-49a7-a07a-ecbb1fccd158/97346038850.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/62e4f79e-8ffa-4cf5-9382-f4669dee97db/jbl_sb400_not_working.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7bd48971-e735-47a1-99f6-793ba6ae8103/dolores_cannon_books_online.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b01067d7-4f48-4062-85ef-21f09aff1554/95788242140.pdfIn PDF document text
    • http://gamosaratiresed.rf.gd/what_are_some_french_expressions.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/97225b27-33b2-4f47-8c47-95a5e581fe27/posubexev.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3c3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF3C3 5672 bytes
SHA-256: ea81a4ddd7f9309377eb6b0fdeb34d435371c3e153a125e1287facc59c0de09b
font_01_sfnt_off00010716.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10716 1864 bytes
SHA-256: 517e36b29c79ad02c7091953d795556664b0cf08914a702653e7c4510e306ce6
font_02_sfnt_off00011044.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11044 10656 bytes
SHA-256: 55c64b0463dbddf48e04b147e1e4fbb9d25aa30d847b42df46ecb3fbeeacfc0d
font_03_sfnt_off000134de.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x134DE 16116 bytes
SHA-256: 3dae81b76154e7c62b3b0d30507344c78f02ee9172d09a03fe7a9af96af9e849

Open this report in the interactive analyzer, or submit your own file for analysis.