Malicious PDF — malware analysis report

Static analysis result for SHA-256 442be44e804b08f1…

MALICIOUS

PDF

72.6 KB Created: 2021-06-10 06:55:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 735d93eda9ad97058ed0a9c832d60f27 SHA-1: 3c0fe86754c640c030332bd1bf199fbeab5ad88c SHA-256: 442be44e804b08f1b0e9e27bf75fedf43c1cc8945d02bd5ab806f736d3184089
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The document body, though heavily obfuscated, contains text related to 'Gcam for redmi note', suggesting a lure. An external URI pointing to 'huntic.ru' was also extracted, likely serving as a phishing or malware distribution link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://huntic.ru/pbw?utm_term=gcam+for+redmi+note PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4449768/normal_5fee2a72c6783.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4486535/normal_5ff65016bcacc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370057/normal_603e2e1f1d7d2.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4370540/normal_5fceabef2a274.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4452607/normal_605f9e2973511.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4419430/normal_5fdf5821e0bd8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4455658/normal_5fda87b483d08.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://giwupiraride.pbworks.com/w/file/fetch/144476436/broadcom_bcm43142_bgn_wifi_adapter_driver_windows_7.pdfIn PDF document text
    • http://fepazonavu.pbworks.com/f/restaurants_near_me_on_the_water_nj.pdfIn PDF document text
    • http://paditoxef.pbworks.com/w/file/fetch/144484392/18443120207.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a8c987fd-e4bd-4af3-bec4-f5da2f765a51/9424327989.pdfIn PDF document text
    • http://xesimisejek.pbworks.com/w/file/fetch/144500640/how_to_recover_deleted_chrome_history.pdfIn PDF document text
    • http://nosegawibaso.pbworks.com/w/file/fetch/144524652/zugupabaso.pdfIn PDF document text
    • http://vixasoli.pbworks.com/w/file/fetch/144932685/career_path_art_and_design.pdfIn PDF document text
    • http://fogofalo.pbworks.com/f/mazupananugepemidalub.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/02797dfd-541a-4f37-a14e-1f1119de4232/drunk_uno_rules_with_beer.pdfIn PDF document text
    • http://kesowununak.pbworks.com/w/file/fetch/144592305/pesivuvoxinolaw.pdfIn PDF document text
    • http://firupoxig.pbworks.com/f/how_to_reset_liftmaster_keypad_without_enter_button.pdfIn PDF document text
    • http://legesir.pbworks.com/f/how_to_reset_filter_on_whirlpool_refrigerator.pdfIn PDF document text
    • http://giwupiraride.pbworks.com/w/file/fetch/144569325/devekegulitelolovezevon.pdfIn PDF document text
    • http://supijexed.pbworks.com/f/18822747935.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de3b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE3B 4988 bytes
SHA-256: 658d0409ece8038c79ed6822c7f3698bd2452a981bc6c27cb5b484ff45f6925e
font_01_sfnt_off0000ef26.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF26 11352 bytes
SHA-256: 81393cdcc7064d40769a7af8f39af3cfb501889feb9ab1c85a039ce692f3039d

Open this report in the interactive analyzer, or submit your own file for analysis.