Malicious PDF — malware analysis report

Static analysis result for SHA-256 49a011f642d8394d…

MALICIOUS

PDF

79.0 KB Created: 2021-03-10 13:21:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 06c954299917899bfb1195202d2acaef SHA-1: ae05a8193795a6f9e987d546681f2f3a2f163ccc SHA-256: 49a011f642d8394d99e2a081665ee4c9cc3de6925278a40062449d43ba5b4582
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains a link to a suspicious external URL, identified by ClamAV as a phishing trojan. The document body, though heavily obfuscated, suggests a lure related to 'labor absenteeism'. The presence of an external URI and the ML classifier's high confidence indicate a malicious intent to redirect the user to a harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/award?keyword=tipos+de+absentismo+laboral+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4369794/normal_603d2296b317c.pdfIn PDF document text
    • http://barajofa.mywebcommunity.org/tenuzawusopebuledefuli.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4390642/normal_5fc7cc7ad2aa6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454966/normal_6026e257df280.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476133/normal_603c10c3d184a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4527164/normal_5fc8ae6a3aecf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445324/normal_60299b910025e.pdfIn PDF document text
    • http://ferategaj.scienceontheweb.net/magnavox_dvd_recorder_vcr_zv427mg9.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4459630/normal_6002c3121064c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/bugutaj/gajipisafaxojowopotolo.pdfIn PDF document text
    • https://s3.amazonaws.com/luropi/sintomas_do_cancer_de_mama.pdfIn PDF document text
    • https://s3.amazonaws.com/dutimajizowa/53921795280.pdfIn PDF document text
    • https://s3.amazonaws.com/regegozumekoza/circulatory_system_diagram_worksheet_ks2.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/37d02225-65de-49ea-8d62-ab1b1b8e8801/club_car_precedent_parts_and_accessories.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d0a20269-0b3b-45b3-b445-96eef12f1eba/roland_micro_cube_gx_guitar_amplifier_red.pdfIn PDF document text
    • https://s3.amazonaws.com/zepifudoxapo/towojopegazutufugu.pdfIn PDF document text
    • https://s3.amazonaws.com/bolovopizonuki/high_heel_platform_boots_mens.pdfIn PDF document text
    • https://s3.amazonaws.com/jeromisixinolib/84685642028.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7fc753f9-562c-4385-8df9-78aa0beb9f0d/41848278484.pdfIn PDF document text
    • http://wojibikifi.myartsonline.com/how_do_you_pray_the_peace_rosary.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e152.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE152 5064 bytes
SHA-256: 259869c6a14d63a794c562313576efbe8c277d81039aa5aa0b2a519461bbd58b
font_01_sfnt_off0000f258.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF258 14260 bytes
SHA-256: c7ae0aa5b4c8f5172db986796e8ba36e5c26edb4c53638eee317261b653ff97f
font_02_sfnt_off00011ec8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11EC8 4324 bytes
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e

Open this report in the interactive analyzer, or submit your own file for analysis.