Malicious PDF — malware analysis report

Static analysis result for SHA-256 4294e54a62bf48ec…

MALICIOUS

PDF

77.9 KB Created: 2021-05-16 21:25:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 24f6484e486606141be588c57eebb02e SHA-1: 712cadfcadec08ad7df71131c54626e40129d9f1 SHA-256: 4294e54a62bf48ec3c07d0104017c91faf15677292c16ea4d3dd688d7e27c6c2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. The document body, though heavily obfuscated, contains text related to a common search query, suggesting a lure. The embedded URI points to a URL that likely hosts a malicious payload or phishing page.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/strik?utm_term=why+won%2527t+my+ipod+nano+stay+charged
    • https://cdn.sqhk.co/dodiniwotud/ibQiena/51928422218.pdf
    • https://cdn.sqhk.co/viwitukaz/ef2gghe/xokobeverixafafajabine.pdf
    • https://cdn.sqhk.co/ketejeti/iccVqd5/top_live_channels_on_youtube.pdf
    • https://cdn.sqhk.co/pifizumux/ie8gigj/cnet_ccleaner_android.pdf
    • https://cdn.sqhk.co/mifigatira/idgejij/lonerider_brewery_wake_forest.pdf
    • https://cdn.sqhk.co/rapovixovuti/jahaKge/tidasarubunenuronisenut.pdf
    • http://pufasesewevobe.22web.org/55325957879.pdf
    • https://cdn.sqhk.co/sugojipo/bijjejg/car_tax_and_title_calculator_florida.pdf
    • https://cdn.sqhk.co/mumesimasozo/igBzugc/monument_valley_game_free_download_for_pc.pdf
    • https://cdn.sqhk.co/susononuz/fr9Togc/car_mechanic_simulator_2018_xbox_one_controls.pdf
    • https://cdn.sqhk.co/dumotometapo/jq8jgnc/wifi_analyzer_free_ios.pdf
    • http://xeboxemovev.66ghz.com/37408349152.pdf
    • https://cdn.sqhk.co/bebomopakax/zI3kljf/31888707053.pdf
    • https://cdn.sqhk.co/zenetofuma/jhb6nWQ/togunonuxosazoroku.pdf
    • https://cdn.sqhk.co/pofevadamem/hghahgi/rareform_backpacks_shark_tank.pdf
    • https://cdn.sqhk.co/gotakavapu/gixjhwL/ouroboros_dragon_breeding_combination.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://jimabepur.rf.gd/mezukuxukadaxuzema.pdf
    • http://kubozivomojiva.epizy.com/sharepoint_2013_training_classes.pdf
    • https://uploads.strikinglycdn.com/files/1e65887a-d1b5-471f-ace1-eb02d7180c83/how_tall_are_hurdles_for_middle_school.pdf
    • http://mawokale.myartsonline.com/adjektivdeklinationen_bungen.pdf
    • http://muluwokixo.onlinewebshop.net/is_salems_lot_a_movie.pdf
    • http://wozitoso.atwebpages.com/93402376316.pdf
    • https://uploads.strikinglycdn.com/files/7a48400c-1d1a-4f0c-831d-7da2317d98e5/world_war_z_game_crossplay_release_date.pdf
    • http://megisaduvivegi.epizy.com/buzof.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f025.bin
19d683d05f58b50e8f9f875a4a40c877ff4865cc08efa44a81f3e2ea37f87a24		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF025 5696 bytes
font_01_sfnt_off0001038a.bin
ce2cfa63f1effa0d1b39f151b6facd0e0b62d8fda2b0e24e9771ec1d1c2e0e93		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1038A 10896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.