Malicious PDF — malware analysis report

Static analysis result for SHA-256 48dd3e4867bc0d48…

MALICIOUS

PDF

76.3 KB Created: 2021-03-20 01:05:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5b15976376044828ba6e9c6027fdf6be SHA-1: 92b01860db50bef33506948dea2630bb64615e46 SHA-256: 48dd3e4867bc0d48aa83a5e8c0f357dcae50eb1036e6f89cb3378131f8df506d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains an embedded URI pointing to 'https://leonvi.ru/wix?keyword=wood+n+things+toys', suggesting a phishing or redirection attempt. No scripts were extracted, but the presence of external URIs and the malware detection strongly suggest the document is designed to lead the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9948

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=wood+n+things+toys
    • https://cdn.sqhk.co/gitesafuwu/iniiQih/asana_create_project_from_template.pdf
    • https://cdn.sqhk.co/xaduwudixum/aiFdHii/93660458039.pdf
    • https://cdn.sqhk.co/puwidebudojo/HMhcChf/turelubuzo.pdf
    • https://cdn.sqhk.co/fuvebopeweb/DVkidAu/vibategemiduluzepuresag.pdf
    • http://tixesikixux.mygamesonline.org/bitatonowizufibarojozojo.pdf
    • http://xofelivigavas.mywebcommunity.org/hootoo_tripmate_elite.pdf
    • https://cdn.sqhk.co/miwataxanis/TxvkWlK/vujiba.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://kabofed.rf.gd/poruxuwujiro.pdf
    • https://5c2cca0d-3a4e-48b0-93bf-8ac6c0c026cb.filesusr.com/ugd/271e65_8b0d01aebf3d480cb76de68cd9e83623.pdf?index=true
    • https://2f60c0de-bae8-48d8-8f3f-ce7907f87c52.filesusr.com/ugd/badafb_b02abd9191c44a0ab15111d52f24a2c0.pdf?index=true
    • https://8eefcaf3-52f5-4123-8be5-b1f0aaeea45e.filesusr.com/ugd/1d3654_717b2362d3a34d3eb746944af9508d52.pdf?index=true
    • https://b2fc43c4-60ab-4dc1-a1c8-84833fda4e2a.filesusr.com/ugd/37321e_79b5e4adb3ea4b4c8094dce50ef8efad.pdf?index=true
    • http://tikimiwuwal.myartsonline.com/khalifah_dinasti_abbasiyah.pdf
    • https://s3.amazonaws.com/libeganot/bed_sheets_set.pdf
    • https://ee6bc897-aa08-459d-b6e6-b1b1d69fcba1.filesusr.com/ugd/7ba596_b1e56ed93fc54df09ae8ad2437b72620.pdf?index=true
    • https://7f03322d-63d6-449b-a8c2-a80beffeb2b6.filesusr.com/ugd/2994dd_12011f02dc5442a5aef7fe9938e54ace.pdf?index=true
    • https://72cee60b-533f-4fda-9f40-87b1bb6f0553.filesusr.com/ugd/590778_b54d19e395c64a11b4d49fdc0f2551ae.pdf?index=true
    • https://2c549fd3-bbcc-4e43-aea5-84609313cfd4.filesusr.com/ugd/c162b3_986156d7a2bc424a946062716bda4837.pdf?index=true
    • http://japixunatavaxi.rf.gd/64328456057.pdf
    • https://b5b764bc-4fc6-48d7-9a4b-423a4d05f225.filesusr.com/ugd/3f2390_94dcbc9383bb4e699256295ed916e986.pdf?index=true
    • http://wagiwejakizativ.rf.gd/ejercicios_de_angulos_en_posicion_normal.pdf
    • http://seroroxunabolu.onlinewebshop.net/2167515762.pdf
    • https://s3.amazonaws.com/gotenukevepunin/ladajofa.pdf
    • https://s3.amazonaws.com/kifutizijebuj/zelutodidapodutuxovudi.pdf
    • https://s3.amazonaws.com/fidobakipivogit/lupum.pdf
    • https://s3.amazonaws.com/gurupixabogivaz/academic_performance_meaning_in_tagalog.pdf
    • http://zuxeretufem.rf.gd/the_algorithm_design_manual_filetype.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d6f8.bin
7e2076b4de9814972d497260c2b9181fe8ac39c4dd2457084de134b633803db6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD6F8 4864 bytes
font_01_sfnt_off0000e79c.bin
703530f371f39198634a632b646cca1b78be4c5b3e1b279368aa9076f39f34ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE79C 11220 bytes
font_02_sfnt_off00010d88.bin
73bb1f519e29941fc98367ae33a8b679223d41029fbf73fb5c585da9ec8c2502		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D88 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.