Malicious PDF — malware analysis report

Static analysis result for SHA-256 43dad011fb70faa7…

MALICIOUS

PDF

76.3 KB Created: 2021-04-01 07:33:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2477a821c4ee0804d6b456f398463fbd SHA-1: 77b83ae5a4e4adf0f57bee8ed075b1de57672b2e SHA-256: 43dad011fb70faa743ce3f94431b7523884c54b4cf53c1475e21988b29fb8412
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a critical heuristic firing for ClamAV detection. The document body, though heavily obfuscated, contains text suggesting a lure related to 'retinol'. A PDF_URI heuristic points to a suspicious URL, https://vilenefex.ru/award?keyword=retinol+adalah+pdf, which is likely used to host or redirect to a malicious payload. No scripts were extracted, but the PDF structure and URL suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/award?keyword=retinol+adalah+pdf
    • https://cdn.sqhk.co/mixubiki/RheGcgc/22506193812.pdf
    • https://pemejelusapi.weebly.com/uploads/1/3/1/3/131398576/94f9c.pdf
    • https://cdn.sqhk.co/wadupaxi/mXC9oIe/67013518904.pdf
    • https://cdn.sqhk.co/rolileduvof/fiibhj1/25108181791.pdf
    • http://sowugadawalu.iblogger.org/27739945411.pdf
    • https://natuxebifenukud.weebly.com/uploads/1/3/1/3/131378868/edc883822c92b.pdf
    • https://cdn.sqhk.co/devepogisog/7jcCIig/hack_game_score_hero_ios.pdf
    • http://wejowadizabudex.mypressonline.com/7430807304.pdf
    • https://static.s123-cdn-static.com/uploads/4457573/normal_600941d85f7d4.pdf
    • https://cdn-cms.f-static.net/uploads/4455672/normal_6058f9d8dca6d.pdf
    • https://cdn.sqhk.co/kisereta/frrhcuW/abraham_maslow_s_theory_of_motivation.pdf
    • https://cdn-cms.f-static.net/uploads/4381082/normal_60175ce00e603.pdf
    • http://sukutoxuwurif.mywebcommunity.org/robizilisofipofeb.pdf
    • https://tavutafaj.weebly.com/uploads/1/3/1/4/131482866/7108923.pdf
    • http://tevaruv.sportsontheweb.net/star_wars_comic_book_chronology.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://xuxalonitu.onlinewebshop.net/52994965706.pdf
    • https://587b455d-cc79-4428-8e80-a8b75ce23bca.filesusr.com/ugd/021ec8_74acf1ccfaea49808a0bede62dda3bdc.pdf?index=true
    • http://jeduxotikeg.rf.gd/17389398103.pdf
    • https://f72e0e13-a873-49c5-9cb5-3c2848b8c5b2.filesusr.com/ugd/f8ba4b_a614c8a671a14d1191eab0107ee42581.pdf?index=true
    • http://femodizabofowu.epizy.com/furakovikafetek.pdf
    • http://lokuvutifinulef.rf.gd/vetodij.pdf
    • https://eb7ae0bc-69c2-4833-8adb-ed465737bb77.filesusr.com/ugd/23493e_1e909e0486e7458ab18ebcf5645d9db2.pdf?index=true
    • https://920f4c01-5fd6-4c40-8b27-b99972fecb60.filesusr.com/ugd/d63aaf_3ecd83c3461e40a1aa677a166153a3d7.pdf?index=true
    • http://samajusinifako.atwebpages.com/biological_wastewater_treatment_leslie_grady.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed8c.bin
b10ab61ab48edf9bba8de137aafa3998ead3bb4147ef6bc16007b75616f1722b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED8C 4864 bytes
font_01_sfnt_off0000fe1e.bin
6e2c692144e1c7ef15f7cb8b743adec1d3554c7d9987fd36fd1a91639aaeb6dd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE1E 10728 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.