Malicious PDF — malware analysis report

Static analysis result for SHA-256 4188b0c5d280b0f5…

MALICIOUS

PDF

86.0 KB Created: 2021-04-05 01:05:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3aa65b3a33d7bba530f898b3582bc30c SHA-1: d5681a89a17c2f7a6025671a902a10b3f700fc23 SHA-256: 4188b0c5d280b0f5dae0380e42b68a4ff9c758b626ace83e2c7ba170ca383f6f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains an embedded URL pointing to 'maypoin.ru', which is likely used to deliver a malicious payload or conduct phishing. The document body, though heavily obfuscated, suggests a 'tv guide dvd' lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9951

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=tv+guide+dvd
    • https://cdn-cms.f-static.net/uploads/4451927/normal_60288ad75915d.pdf
    • http://warajuvevuv.medianewsonline.com/le_dialogue_des_carmlites_bernanos.pdf
    • https://cdn-cms.f-static.net/uploads/4418401/normal_6062881e43f3e.pdf
    • https://cdn-cms.f-static.net/uploads/4458137/normal_604da64e9dfd4.pdf
    • https://cdn-cms.f-static.net/uploads/4459323/normal_600a24503fba1.pdf
    • https://cdn-cms.f-static.net/uploads/4366369/normal_604611c50846a.pdf
    • https://static.s123-cdn-static.com/uploads/4443821/normal_600107e08977d.pdf
    • http://xewaxoweva.22web.org/79678113594.pdf
    • http://levotavo.scienceontheweb.net/automation_tia_portal.pdf
    • https://cdn-cms.f-static.net/uploads/4458394/normal_605f4c799cf07.pdf
    • http://mobufuwiwid.medianewsonline.com/why_is_my_spectrum_cable_tv_not_working.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://d190c387-1498-4382-a59e-98d1a0a9794c.filesusr.com/ugd/a91264_0196f57ec2de4a969208ead50afd7ca8.pdf?index=true
    • https://b2f02272-107b-4032-aafc-54cdd6265a16.filesusr.com/ugd/6cf392_a680aa9555064ba6b47ec16c31453114.pdf?index=true
    • https://s3.amazonaws.com/goviwigax/veterinary_obstetrics_and_genital_diseases.pdf
    • http://xazogugikuriwox.rf.gd/ohio_common_core_standards_math_8th_grade.pdf
    • https://s3.amazonaws.com/mudurixo/5847225670.pdf
    • http://turuduje.epizy.com/pioneer_elite_pro_507pu_owners_manual.pdf
    • https://s3.amazonaws.com/sazomo/video_editor_mac_free.pdf
    • https://3350d16e-2476-487b-844f-3942c02081ad.filesusr.com/ugd/25270e_95122e72451f4e6892dca24d9547b262.pdf?index=true
    • http://remavamabemasa.rf.gd/bsf_recruitment_2020_offline_form_download.pdf
    • http://zinizebaki.epizy.com/despacito_easy_piano_sheet_music_free.pdf
    • https://s3.amazonaws.com/pizexopenaxu/magnetocrystalline_anisotropy.pdf
    • https://s3.amazonaws.com/fuwawibu/tikotazorifos.pdf
    • https://d1b33a7b-cde1-45d4-bc15-d4d3b6236ac5.filesusr.com/ugd/1d64af_7bec33547d954de19678d8a3a492c01a.pdf?index=true
    • http://foduxidepozipiw.myartsonline.com/bazupezolizozixi.pdf
    • http://jadukubilelib.myartsonline.com/paul_bunyan_and_babe_the_blue_ox_story.pdf
    • https://e4da1597-3bb3-488b-9226-7c2c9e06e9ce.filesusr.com/ugd/db5d73_18e45dec918d438fad02ad22f3f789b5.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000107a6.bin
6442e1976eb9ac7b2fb39021567736c1e91213b495eefca14b94abcc66822806		 pdf-font-stream PDF embedded font (sfnt) at offset 0x107A6 4072 bytes
font_01_sfnt_off0001157a.bin
7bbe3d0ff66553d796f03aa9e8f971873b56435ca4cd7e9628f067816e05d900		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1157A 11568 bytes
font_02_sfnt_off00013c8a.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13C8A 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.