Malicious PDF — malware analysis report

Static analysis result for SHA-256 4b8f4d1c2d652614…

MALICIOUS

PDF

79.0 KB Created: 2021-03-12 03:32:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 68e11e6eb256e04062ba4eeda28e26a1 SHA-1: 53c2ad03970fce92c8809ce331a4a31effdbc229 SHA-256: 4b8f4d1c2d6526141bf550d12f90799c3fabe686277c54bbd0efe4dc9b9d73bc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing site. The document body is heavily obfuscated, but the presence of embedded URLs and the overall detection profile strongly suggest a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=ib+psychology+ia+word+limit
    • https://cdn.sqhk.co/fegukajebaj/Ijb2q0k/stick_z_warriors_super_fight_apk.pdf
    • https://cdn-cms.f-static.net/uploads/4415936/normal_6039b43d8aaee.pdf
    • https://static.s123-cdn-static.com/uploads/4411916/normal_5fe08b772d698.pdf
    • http://fimokeroda.22web.org/45667711247.pdf
    • https://cdn-cms.f-static.net/uploads/4474457/normal_6026dfcc71cab.pdf
    • https://cdn-cms.f-static.net/uploads/4369491/normal_60375dae415f9.pdf
    • https://static.s123-cdn-static.com/uploads/4416805/normal_5ff9a72ddc4ed.pdf
    • https://cdn-cms.f-static.net/uploads/4477638/normal_602638900c96e.pdf
    • https://cdn.sqhk.co/wowobavukelo/BrXjahi/lyft_request_a_ride_online.pdf
    • https://cdn-cms.f-static.net/uploads/4446170/normal_602839f1c39cb.pdf
    • https://static.s123-cdn-static.com/uploads/4498345/normal_5fe34890e0e57.pdf
    • https://cdn.sqhk.co/fiwujumejuf/Ogehjds/tinudiwuvikovuxolavuz.pdf
    • https://cdn.sqhk.co/zoxowowi/hjkeict/the_rider_iowa_city_hotel.pdf
    • http://maxovulosaxa.22web.org/binks_sake_cello_sheet_music.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/68dc63b5-fdec-4674-a0e0-d252a88ada2f/how_to_play_fast_money_round_on_family_feud.pdf
    • http://borarizi.epizy.com/what_does_post_stand_for_in_medical_terms.pdf
    • https://uploads.strikinglycdn.com/files/9c99547a-e132-4144-93a0-2c3477e7ccf0/vejuwoz.pdf
    • https://uploads.strikinglycdn.com/files/fa03f7e3-9aaa-4d15-83c9-a1924dca6e0d/95354659403.pdf
    • https://uploads.strikinglycdn.com/files/4ee6df8f-30ba-4313-93c4-d93826307d6d/38025649218.pdf
    • https://uploads.strikinglycdn.com/files/1187c328-c70b-419a-8007-578937689d04/wirif.pdf
    • https://uploads.strikinglycdn.com/files/2e56824b-17db-4066-b1db-6c2fa849963f/who_is_the_rudest_female_kpop_idol.pdf
    • https://uploads.strikinglycdn.com/files/2b1c200f-507d-4d9a-9021-fdfc9a97a896/91911759255.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f85c.bin
8057fdb0943a1c00073182567f8504e0e00c7d7c1666630de28a7cfd6fcb8d54		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF85C 5756 bytes
font_01_sfnt_off00010bdb.bin
fb958bc8029af8d35ccb08ee8afc356e4f76eb6158ef48724771be252dd877cf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10BDB 10236 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.