Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c1e16673d512805…

MALICIOUS

PDF

115.9 KB Created: 2021-03-10 06:37:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-07
MD5: 948a7f586d4d037bc76adcc33bbc0a9b SHA-1: e020db13e79ebb0b5d02eb4d2eb555888ae7da98 SHA-256: 4c1e16673d5128058456e7c5ca0f9666cf6e921ba7d52af85d75920a044f8420
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that masquerades as a search result for book quotes, likely to trick users into visiting a malicious site. ClamAV and ML classifiers strongly indicate this PDF is malicious, specifically flagged as a phishing trojan. The presence of multiple unknown URLs suggests a broader campaign for distributing malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=love+simon+book+quotes PDF link annotation
    • http://vatetuda.scienceontheweb.net/5th_grade_math_test_new_york_state.pdfIn PDF document text
    • https://xidibifolun.weebly.com/uploads/1/3/2/7/132710634/5937224.pdfIn PDF document text
    • http://zexaribamemavi.sportsontheweb.net/56674905758.pdfIn PDF document text
    • http://luxasireku.sportsontheweb.net/85571404616.pdfIn PDF document text
    • http://mebevevi.mywebcommunity.org/wavatudenagova.pdfIn PDF document text
    • http://lodomujimujug.mywebcommunity.org/vajojipizebi.pdfIn PDF document text
    • https://nimaxinamupun.weebly.com/uploads/1/3/4/6/134635612/vexisiro.pdfIn PDF document text
    • https://puwedogomep.weebly.com/uploads/1/3/1/3/131382223/fadela_wuxuxebumojano_darofupatoluve_vavojakep.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/leteraxewe/craftsman_12_inch_band_saw_specs.pdfIn PDF document text
    • https://s3.amazonaws.com/levovod/android_wear_watch_faces_star_trek.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/76bcc5bb-9908-4da4-8b74-e7aeed9bafb1/black_and_decker_air_fry_convection_toaster_oven.pdfIn PDF document text
    • http://kirutitas.epizy.com/acids_bases_and_salts_class_7_mcq_worksheet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/24d4b620-2713-4e25-8796-2b7f2a2b461b/sistema_endocrino_estructurales.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/45a7e969-76a2-4dc9-8c21-35d65f257357/the_bluest_eye_toni_morrison_book.pdfIn PDF document text
    • http://guvubaxi.epizy.com/jorikep.pdfIn PDF document text
    • https://s3.amazonaws.com/nawosineromigi/vudunu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ebdede0a-c870-40c2-ad78-30439f96d2d1/plane_shift_amonkhet_dnd_beyond.pdfIn PDF document text
    • https://s3.amazonaws.com/tiluwisulepam/the_heart_of_darkness_summary_chapter_1.pdfIn PDF document text
    • http://fepetixapokurob.myartsonline.com/picadura_de_abeja_en_nios.pdfIn PDF document text
    • http://nozozuwovore.atwebpages.com/maytag_quiet_series_200_parts_canada.pdfIn PDF document text
    • https://s3.amazonaws.com/jujadodedaruxix/6316340823.pdfIn PDF document text
    • http://viniwowosur.onlinewebshop.net/how_to_fix_writing_pad_on_mouse.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/89946de7-5b47-4ef6-981c-a1d8aae82608/line_6_spider_3_75_watt_no_sound.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00018b37.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18B37 4824 bytes
SHA-256: 59212dbd54f1ee5d725d84f7f36aaab62953a12aa5dec2c112d833c3da53bd9f
font_01_sfnt_off00019ba3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19BA3 11176 bytes
SHA-256: 8e2a25d4e39cd549f093957260c0882e6153a64ddfa7b2a28458217356236a8d

Open this report in the interactive analyzer, or submit your own file for analysis.