Malicious PDF — malware analysis report

Static analysis result for SHA-256 46082a6e188887b2…

MALICIOUS

PDF

75.1 KB Created: 2021-03-16 17:34:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1eb6b48b5b2dc23cbcf12c2741d951ed SHA-1: be141ee8fba2c17918873434dd65328b7cd2ffeb SHA-256: 46082a6e188887b2074b843347433e3d2f5e6ac11573556dad41f2beb0c86848
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing an embedded URL that points to a suspicious domain, identified by ClamAV as a phishing trojan. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, contains keywords that might be used as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/award?keyword=bradykardia+p%25C5%2582odu+pdf
    • https://cdn.sqhk.co/diwomijo/iehiaij/top_movie_sites_illegal.pdf
    • http://ponopawux.iblogger.org/tazesogase.pdf
    • http://ledozikatiresev.scienceontheweb.net/acca_f9_notes.pdf
    • http://ruvujagefeko.mygamesonline.org/grimorium_verum_the_true_grimoire.pdf
    • https://cdn.sqhk.co/madumubo/RYjigj5/accu_battery__3336.pdf
    • https://cdn.sqhk.co/mivadunoxo/hjc5hbD/piano_chatal_band_download.pdf
    • https://cdn-cms.f-static.net/uploads/4417662/normal_604420bb53982.pdf
    • http://xapozekaxo.iblogger.org/pronombres_posesivos_en_ingles_ejemplos_oraciones.pdf
    • http://zifeladawu.scienceontheweb.net/76171465963.pdf
    • http://kavelizopepi.mywebcommunity.org/the_sims_3_pets_pc_download_utorrent.pdf
    • https://cdn.sqhk.co/sejukuxa/JPjhchi/english_gentleman_style_guide.pdf
    • https://cdn.sqhk.co/bisuligiga/ij9giNl/73087991879.pdf
    • https://cdn.sqhk.co/lemisobe/4ij8IFW/lavender_lemonade_recipe_low_sugar.pdf
    • https://cdn.sqhk.co/mejofiwog/8Kb3gfI/the_cult_of_domesticity_refers_to.pdf
    • https://static.s123-cdn-static.com/uploads/4446923/normal_5fed4df789fea.pdf
    • https://cdn.sqhk.co/risenulowo/cidYhiG/fabajitoxa.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/1b486f49-31b6-4d08-b178-4a9082a1fbe7/calendario_lunar_septiembre_2020_colombia.pdf
    • http://bajupigirosinaf.atwebpages.com/4351878184.pdf
    • http://pabizazixivak.epizy.com/los_barcos_que_vuelan.pdf
    • https://uploads.strikinglycdn.com/files/6074f728-c795-416b-8643-7263856343da/how_much_was_davids_ferrari.pdf
    • https://uploads.strikinglycdn.com/files/80b803a3-1b56-44d8-9a27-b60f303fefa3/id90_travel_careers.pdf
    • https://uploads.strikinglycdn.com/files/660dee9f-b88f-4c2c-9dd4-25e0a343b72f/pakanejafakujovuludamava.pdf
    • http://nukuzuxowilaz.epizy.com/find_duplicate_values_in_multiple_sheets_excel.pdf
    • https://uploads.strikinglycdn.com/files/dc91d7e1-fb31-4860-b01a-4a8bd0125f3c/90905978892.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e5cb.bin
20fc8f277d839be63e373826e017b49d18f887066ed1377801c8a998b2227daf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE5CB 5096 bytes
font_01_sfnt_off0000f747.bin
d8da1ede0584be84b63c3c62cf6db28a9ac907abb9d68b09cebffae1d2817cf9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF747 11884 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.