Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a0f4cc61582782c…

MALICIOUS

PDF

87.0 KB Created: 2021-03-19 11:25:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9411709db62c2b515fc85db595eedfd9 SHA-1: 787f07649398411321f3e591b9213b81e9655e9f SHA-256: 4a0f4cc61582782c37ffb2607506dc5fb8a52a7b34c0514dc956079b72fdcf5a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to 'maypoin.ru', which is likely a phishing or malware distribution domain. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a book title, suggesting a lure to trick users into visiting the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=warrior+cats+crowfeather%2527s+trial+pdf
    • http://jeratojovu.66ghz.com/36986405429.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/d3383d67-cbd1-4099-9825-00717442d74c/41576381329.pdf
    • https://uploads.strikinglycdn.com/files/7b687a1e-d811-4d97-be04-b7ab838caac4/best_holmes_humidifier.pdf
    • http://joriboka.epizy.com/tarkovsky_book_sculpting_in_time.pdf
    • http://supapimegem.rf.gd/term_loan_in_balance_sheet.pdf
    • https://s3.amazonaws.com/gateme/43257245666.pdf
    • https://s3.amazonaws.com/pozokimepe/18811027056.pdf
    • https://s3.amazonaws.com/lopadivupudexa/sarazodel.pdf
    • https://uploads.strikinglycdn.com/files/6b83b48f-85db-468b-93f7-732375f99633/ar_blue_clean_383l_hose.pdf
    • https://s3.amazonaws.com/waduzirader/12256301330.pdf
    • https://uploads.strikinglycdn.com/files/2753736e-bd00-4ada-9b62-5afe03777953/nofodukabinosuxowureb.pdf
    • https://s3.amazonaws.com/bupaxomu/most_used_social_media_platforms_in_china.pdf
    • https://s3.amazonaws.com/jejulurowev/vuxarapetuxosunodo.pdf
    • https://s3.amazonaws.com/nitirew/netflix_1080p_android.pdf
    • https://uploads.strikinglycdn.com/files/377480fd-de23-45bf-bd4b-0227d9808f65/65191496428.pdf
    • https://s3.amazonaws.com/vutame/chloroform_solvent_nmr_peak.pdf
    • https://s3.amazonaws.com/fajetufekejo/kigezebefajeroben.pdf
    • https://s3.amazonaws.com/muwemivumazulax/formalism_literary_criticism_ppt.pdf
    • https://s3.amazonaws.com/lusegokaves/axa_ppp_international_claim_form.pdf
    • https://s3.amazonaws.com/mokamoba/89727046835.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010574.bin
ac52e7c133b4868de51f64fd94bdc8fd375b5b232b61de938c0f7ac818f6d24e
pdf-font-stream PDF embedded font (sfnt) at offset 0x10574 4708 bytes
font_01_sfnt_off000115c2.bin
3c67f774414435ea133e8effda195cf6e9cc1b5d8c33e955741fa1a07cf02965
pdf-font-stream PDF embedded font (sfnt) at offset 0x115C2 5380 bytes
font_02_sfnt_off00012829.bin
30cbadcdb98af2e8b550f9481d679a2289b04daac0191540a339e6ced18af109
pdf-font-stream PDF embedded font (sfnt) at offset 0x12829 11396 bytes