Malicious PDF — malware analysis report

Static analysis result for SHA-256 4db8a74ade091129…

MALICIOUS

PDF

77.0 KB Created: 2021-03-16 23:32:25 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1988d23c6ca0c8bef2611bb9919d0025 SHA-1: 90023d21c228d8525110e70a5ddab32cdac3aebf SHA-256: 4db8a74ade09112918f94ed744f4181ae2fb86ef7f5d41e54dfa39b44481c61f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://xezojetit.ru/wix?keyword=seekers+notes+cheats+ipad', suggesting a phishing or malware distribution lure. While no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a malicious document designed to trick users into visiting a compromised site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=seekers+notes+cheats+ipad
    • http://creditscoretracking.info/53359907105x8vad.pdf
    • https://pejexiguwela.weebly.com/uploads/1/3/1/1/131164442/c71e250b.pdf
    • https://xodimazu.weebly.com/uploads/1/3/1/4/131408168/663791.pdf
    • https://zugufirit.weebly.com/uploads/1/3/1/1/131163535/8015700.pdf
    • https://sifajovu.weebly.com/uploads/1/3/4/8/134874608/5262978.pdf
    • https://fewanisip.weebly.com/uploads/1/3/2/7/132712603/4fc2ef.pdf
    • https://cdn-cms.f-static.net/uploads/4413713/normal_6020958d2032d.pdf
    • http://lynciguest.com/roxozixakiwumadesanux936hd.pdf
    • https://defaxudenuged.weebly.com/uploads/1/3/5/2/135293647/680835e67d.pdf
    • https://suxobiras.weebly.com/uploads/1/3/4/6/134614615/kelef.pdf
    • http://liolika-rsya.ru/975882759829111u.pdf
    • https://cdn-cms.f-static.net/uploads/4482418/normal_6050378647c55.pdf
    • https://static.s123-cdn-static.com/uploads/4416806/normal_5fe5b58c86d29.pdf
    • http://tasusala.iblogger.org/basal_temp_chart_template.pdf
    • http://ujjjrrrrr.space/94474987918xleo5.pdf
    • https://cdn-cms.f-static.net/uploads/4380525/normal_604cc1bf5dea7.pdf
    • https://kuxijixa.weebly.com/uploads/1/3/4/8/134856984/sagumubut.pdf
    • http://fredo.bike/factorising_quadratic_expressions_worksheet_tes49759.pdf
    • http://gufufisazikoja.iblogger.org/american_gypsum_sheetrock.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/3d5db013-7175-4df2-ac93-3bb9636c93b0/rumawimudogidab.pdf
    • https://uploads.strikinglycdn.com/files/fae459b3-8c68-4f50-978f-b7465d1cd2a0/musica_himno_nacional_de_honduras_letra.pdf
    • http://fakatidewejuna.epizy.com/how_to_get_in_touch_with_ups_human_resources.pdf
    • https://uploads.strikinglycdn.com/files/30813ba3-6a70-4798-b836-74884d3d16f6/35203309114.pdf
    • http://judimavazamo.epizy.com/duteguwamatoradopazawimu.pdf
    • https://uploads.strikinglycdn.com/files/50edd7cb-020d-42e7-9062-45420eece413/dios_sea_exaltado_letra_y_acorde.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec5a.bin
e08dbd9cc5863a1c6f8a69ad9fc74eed80d3623b91d439c4d1bc0e3b895764b7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC5A 5296 bytes
font_01_sfnt_off0000fe5c.bin
7c00dd20469baf31a86262d47e87ce61afbc3baf6f243d5a845425dfcdf9c54d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE5C 11288 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.