Malicious PDF — malware analysis report

Static analysis result for SHA-256 499fd087d601e18f…

MALICIOUS

PDF

74.1 KB Created: 2021-06-10 15:55:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b9612e851ef9a9f4b8b63672d2c5f95a SHA-1: c33c4dda85e90d755093669b07e10c1698664a2e SHA-256: 499fd087d601e18f20301005fb59d957a557d21d36b3e172492a49e353fdda93
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. An external URI pointing to 'synerhu.ru' was extracted, which is a strong indicator of a phishing or malware distribution attempt. The document body contains obfuscated text, suggesting an effort to hide the malicious payload or lure. No scripts were extracted, but the presence of an external URL and the overall malicious verdict strongly suggest a phishing or downloader attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9956

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://synerhu.ru/pbw?utm_term=lag+ja+gale+ke+phir+ye+hasi
    • https://cdn-cms.f-static.net/uploads/4450039/normal_605d6647d5e67.pdf
    • https://static.s123-cdn-static.com/uploads/4451737/normal_5fcf2dc39407d.pdf
    • https://cdn-cms.f-static.net/uploads/4394072/normal_60316ee9126ac.pdf
    • https://cdn-cms.f-static.net/uploads/4423427/normal_60ba9429b6bc1.pdf
    • https://cdn-cms.f-static.net/uploads/4480589/normal_605323cb4c3e1.pdf
    • https://cdn-cms.f-static.net/uploads/4452850/normal_602abdeaabfec.pdf
    • https://cdn-cms.f-static.net/uploads/4421612/normal_5fd9d8b91c9f4.pdf
    • https://static.s123-cdn-static.com/uploads/4530429/normal_5fde09a60062e.pdf
    • https://cdn-cms.f-static.net/uploads/4370985/normal_604e5aaca62b5.pdf
    • https://cdn-cms.f-static.net/uploads/4410006/normal_60210ef782100.pdf
    • https://cdn-cms.f-static.net/uploads/4458633/normal_605bbba661db5.pdf
    • https://cdn-cms.f-static.net/uploads/4480382/normal_601b0ab569671.pdf
    • https://static.s123-cdn-static.com/uploads/4391893/normal_5fca6c7c4fc64.pdf
    • https://static.s123-cdn-static.com/uploads/4390055/normal_6007c4bf93764.pdf
    • https://static.s123-cdn-static.com/uploads/4418747/normal_600482d6565fe.pdf
    • https://cdn-cms.f-static.net/uploads/4383794/normal_6062255c56ca1.pdf
    • https://static.s123-cdn-static-d.com/uploads/4368240/normal_60b2f065e9841.pdf
    • https://cdn-cms.f-static.net/uploads/4369629/normal_6013dcefd12de.pdf
    • https://cdn-cms.f-static.net/uploads/4529780/normal_602171eeb7aef.pdf
    • https://cdn-cms.f-static.net/uploads/4378153/normal_60625f4569312.pdf
    • https://static.s123-cdn-static-d.com/uploads/4366969/normal_60b7065f5e8f0.pdf
    • https://static.s123-cdn-static.com/uploads/4472208/normal_5fdeca7b29404.pdf
    • https://static.s123-cdn-static.com/uploads/4393508/normal_5fc91b5cc6559.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/55794277-0687-4402-82e0-841fe89c6df4/75304400886.pdf
    • https://uploads.strikinglycdn.com/files/7208c2fe-8858-44af-bbf1-3e22ef6638b8/rezifonulerab.pdf
    • https://uploads.strikinglycdn.com/files/d388ab28-2f47-4845-9571-7207a94c5151/lesevividuxoxixunadedo.pdf
    • https://uploads.strikinglycdn.com/files/58b0ecbb-2c35-4dcc-b5d7-449d8ff13ec0/62911299406.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e5ed.bin
f63529c296e17320d42430c15a8f68866c48de2f2e395830355e23167028c6d7
pdf-font-stream PDF embedded font (sfnt) at offset 0xE5ED 5264 bytes
font_01_sfnt_off0000f7e5.bin
e43f09eaba48d9273c4b9081815d0da17cab24feb34ab50121858a08598fce6e
pdf-font-stream PDF embedded font (sfnt) at offset 0xF7E5 10272 bytes