Malicious PDF — malware analysis report

Static analysis result for SHA-256 41c3207c566a1312…

MALICIOUS

PDF

85.4 KB Created: 2021-03-28 14:49:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dbe709fe4fefbc97399beac135c1750e SHA-1: bdec7384798dbdba8db3675c149f6d2ea7c38c18 SHA-256: 41c3207c566a13123df2e4722a08bdffe01bd2936eeb64da3aa4fd990b9142ba
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a suspicious domain. Static analysis heuristics and a machine learning classifier flagged the PDF as malicious, with ClamAV identifying it as a phishing trojan. The embedded URL is likely used to redirect the user to a malicious site for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=rcbs+chargemaster+lite+vs+hornady+auto+charge+pro
    • https://cdn-cms.f-static.net/uploads/4393348/normal_6025341648cd8.pdf
    • http://kapabifidi.sportsontheweb.net/41169394255.pdf
    • https://cdn-cms.f-static.net/uploads/4473415/normal_600c0322d4b22.pdf
    • https://cdn.sqhk.co/zebapomiz/jaOuHfa/hit_run_steal_batting_tee.pdf
    • https://cdn.sqhk.co/nadipozow/d0sOsfA/sirepowipavojaniberogenik.pdf
    • https://cdn.sqhk.co/wejuladuke/e27vgfa/civ_vi_eleanor_of_aquitaine_guide.pdf
    • https://cdn.sqhk.co/kivipemo/hhjdhid/43068504625.pdf
    • https://cdn.sqhk.co/pasivuzuke/hcgijju/best_war_movies_on_prime_video.pdf
    • https://cdn-cms.f-static.net/uploads/4376849/normal_5fd78ea52f303.pdf
    • https://static.s123-cdn-static.com/uploads/4378836/normal_5ff13570f3096.pdf
    • http://sixesijilolun.mywebcommunity.org/9394850633.pdf
    • http://gixitetopes.scienceontheweb.net/zipipelupuxupovojetaxi.pdf
    • https://cdn-cms.f-static.net/uploads/4406806/normal_60151be47bf22.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/poguvelefa/aula_4_curso_de_espaol.pdf
    • https://uploads.strikinglycdn.com/files/2efdd51d-8fbd-419b-863f-0574002c210a/87682352938.pdf
    • https://562c2315-396f-49d1-9e45-1236e049cb13.filesusr.com/ugd/ec0012_1216a5616085475181436789a860ca89.pdf?index=true
    • https://uploads.strikinglycdn.com/files/4186018b-aefe-4283-8a6e-ea061bcf515d/over_the_rainbow_ukulele_song.pdf
    • https://abee6ad4-cf47-459a-954e-22b9b9bb30ad.filesusr.com/ugd/4bdc6d_6e30bde9a4de4589b147dd411ca27c85.pdf?index=true
    • https://s3.amazonaws.com/nimuwet/vowisoragufotugaxijone.pdf
    • https://0fdd9f25-8366-4660-9463-376fd915ad39.filesusr.com/ugd/c16cf9_5c16ecce947b43e892b813f7991b0865.pdf?index=true
    • https://uploads.strikinglycdn.com/files/d15fac6c-bcf9-4752-bd6a-b9953c365c72/zavidobofusupidik.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010a5f.bin
2ad863a2f88c3ae615a340eed6adc3c5f8b81ec571d1c0f8e5ae2f0a73b81082		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A5F 5796 bytes
font_01_sfnt_off00011df8.bin
381334b62983244d554652320cbf7bcac064fed583a2211a1c77ac19ae19f0cf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11DF8 12340 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.