Malicious PDF — malware analysis report

Static analysis result for SHA-256 4bfae36701f74481…

MALICIOUS

PDF

78.6 KB Created: 2021-04-18 16:42:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8f3f203a2650ec3953ac8a979bc61531 SHA-1: 7e83e7c544174dff7ba5db7a7dd13f686d1cf7dc SHA-256: 4bfae36701f744818594dc21635afdcf3a7baebc286c97fa0df66426f1a2bf73
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, and multiple other URLs that are likely part of a phishing or malware distribution campaign. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware delivery, disguised as a document review.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=bear+archery+approach+rth+bow+package+review
    • http://runolive.com/neduvuxozakifb358w.pdf
    • http://importants.space/garmin_gns_430w_maintenance_manualvz13g.pdf
    • https://cdn.sqhk.co/guxuboru/hdjhghe/uncrowned_will_wight_download.pdf
    • https://cdn-cms.f-static.net/uploads/4417408/normal_602e833601e1e.pdf
    • http://pelistens.xyz/30060619078vexwy.pdf
    • https://rinafudafize.weebly.com/uploads/1/3/5/2/135293322/5952001.pdf
    • https://moraraxewurazi.weebly.com/uploads/1/3/4/0/134042425/woxiz-mavewukovit-ximeraju.pdf
    • https://cdn-cms.f-static.net/uploads/4479916/normal_6051c98746d6c.pdf
    • https://cdn-cms.f-static.net/uploads/4444378/normal_6039f82115722.pdf
    • https://cdn.sqhk.co/sevigexew/iah1xig/bapute.pdf
    • http://wofeboz.66ghz.com/lovely_billie_eilish_cello_sheet_music_free.pdf
    • http://kagutakonupana.iblogger.org/adding_and_subtracting_binary_numbers.pdf
    • http://excschool.ru/ib_mathematics_analysis_and_approaches_textbookjl2oi.pdf
    • https://cdn.sqhk.co/xagunetoxa/hgfjfij/tugunuxevavijomuselapeg.pdf
    • https://cdn.sqhk.co/gujamozulas/27lgOhc/basketball_kings_apk.pdf
    • https://cdn-cms.f-static.net/uploads/4425511/normal_605bf8e5b0e56.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/6c11e649-d65a-48a0-99f0-025ed3c47b6b/epson_workforce_wf-3640_help.pdf
    • https://uploads.strikinglycdn.com/files/0ddef598-4fcf-43a8-a608-3aa92259bc62/15437881407.pdf
    • https://uploads.strikinglycdn.com/files/deda645e-9156-4db8-8dac-e4fe96f480ce/how_to_set_temperature_on_a_whirlpool_refrigerator.pdf
    • http://gifagedopodub.epizy.com/zujenulutifu.pdf
    • https://uploads.strikinglycdn.com/files/71794133-cad7-4f4a-bc88-d3104190d153/freed_fifty_shades_darker_as_told_by_christian.pdf
    • https://uploads.strikinglycdn.com/files/444d2c96-4da7-4f14-bfc7-5509d5d26bac/51443417748.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3e4.bin
c48c077ce72001a1ecae5673c0b311e467a9a00071935c52138c7deda96a6aee		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF3E4 5492 bytes
font_01_sfnt_off000106b2.bin
2487c3b39af744ed640c90804af05967e3780549a780d9ed05006d88313d82f4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x106B2 11192 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.