Malicious PDF — malware analysis report

Static analysis result for SHA-256 4d620f057c3696d8…

MALICIOUS

PDF

91.1 KB Created: 2021-06-07 10:48:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1fbc9589d52998ca86d6cd57aa5cde0c SHA-1: c6d143ea93afa5a234874fdbc59f5f0ac1b3b850 SHA-256: 4d620f057c3696d8fd2b84725548a36c8f5a2d4e575867614b45e0b34026e21f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. The document body, though partially corrupted, suggests a lure related to 'Angle relationships in triangles worksheet answers'. The primary IOC is an external URI pointing to 'https://pelibifir.ru/123?utm_term=angle+relationships+in+triangles+worksheet+answers', which is likely used to host a malicious payload or redirect the user to a phishing site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9917

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/123?utm_term=angle+relationships+in+triangles+worksheet+answers
    • https://cdn-cms.f-static.net/uploads/4403808/normal_60b9b6668c921.pdf
    • https://salasusovalepeg.weebly.com/uploads/1/3/5/4/135401171/xuduzenap-pexedis-sosevotolebaje-ramodurepu.pdf
    • https://cdn-cms.f-static.net/uploads/4408712/normal_5fd1658fd5df7.pdf
    • https://static.s123-cdn-static.com/uploads/4484107/normal_60065239add7f.pdf
    • https://cdn-cms.f-static.net/uploads/4373997/normal_603e2c663458f.pdf
    • https://wunepilupizuxo.weebly.com/uploads/1/3/1/8/131857535/firofaz_ganizu_dugejenitaw_nipovakezigedi.pdf
    • https://cdn-cms.f-static.net/uploads/4367281/normal_602bb864578f2.pdf
    • https://static.s123-cdn-static.com/uploads/4463812/normal_5ff312a93f27c.pdf
    • https://cdn-cms.f-static.net/uploads/4393018/normal_603935b0658b7.pdf
    • https://cdn-cms.f-static.net/uploads/4496391/normal_606b3205bf9cd.pdf
    • https://xuzopodoker.weebly.com/uploads/1/3/0/7/130738955/2660232.pdf
    • https://setojeduvesile.weebly.com/uploads/1/3/4/5/134587971/fb2a05.pdf
    • https://suguturame.weebly.com/uploads/1/3/1/4/131438741/1f6e60b9.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://rukuvekuke.pbworks.com/w/file/fetch/144716049/aashto_lrfd_bridge_design_specifications_7th_edition_without_interims.pdf
    • http://zexowisam.pbworks.com/f/fuxizijigafufogopij.pdf
    • https://uploads.strikinglycdn.com/files/57334f9e-402d-4761-85d1-89722c90ec01/nitecore_i4000r_tactical_flashlight_review.pdf
    • http://sinorodolu.pbworks.com/f/16525073683.pdf
    • https://uploads.strikinglycdn.com/files/12576206-e521-4a9e-965b-df4e05e15b58/14302354352.pdf
    • http://noxiwako.pbworks.com/f/12636929559.pdf
    • http://poforezufovu.pbworks.com/f/avon_catalogue_uk_november_2020.pdf
    • https://uploads.strikinglycdn.com/files/7f51b19a-2b0d-436c-a79a-dbdb005c8c79/fimogepatufig.pdf
    • https://uploads.strikinglycdn.com/files/e7070164-0527-4dbb-820a-9916ae331f1e/how_to_write_a_community_service_hours_letter.pdf
    • https://uploads.strikinglycdn.com/files/81d9769d-6e59-4225-96eb-c21d176347cd/87812949098.pdf
    • http://fatakalewene.pbworks.com/w/file/fetch/144686013/how_to_charge_your_jlab_wireless_earbuds.pdf
    • http://ditidema.pbworks.com/f/calculus_howard_anton_solution.pdf
    • http://visetululiv.pbworks.com/w/file/fetch/144416652/bexulixubevivofep.pdf
    • http://keborekudud.pbworks.com/w/file/fetch/144726582/cuento_de_los_tres_cochinitos_y_el_lobo_feroz.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010012.bin
705377623a4c4344e02470fedf876d1ed6f0c7c0eac322cafb15afc9430d14bf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10012 6440 bytes
font_01_sfnt_off00011006.bin
76f141399a3fdf1b262055856f9429a16155ede69f711175779289c2b8b16976		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11006 5224 bytes
font_02_sfnt_off000121dc.bin
ea099f024f22fa9205975548241108c2e972b2ed345d5384b927ee82ee98f6ea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x121DC 11040 bytes
font_03_sfnt_off000147c8.bin
5fb78d067d9d93985020f27ca5ade0a2351f335057798ee304b895661001e772		 pdf-font-stream PDF embedded font (sfnt) at offset 0x147C8 16180 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.