Malicious PDF — malware analysis report

Static analysis result for SHA-256 4de905f558487521…

MALICIOUS

PDF

69.7 KB Created: 2021-03-13 20:48:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 93ab6bf3eaf797c78df5ca3a56ff3c86 SHA-1: ddcb4f7e32cc32b836b7800117f6312eab7ea141 SHA-256: 4de905f558487521a5a4de4b5e91578df07c18b389b5e084236b9b556865db0e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that uses a lure of a 'Toro lawn master 2 manual' to disguise its malicious intent. It contains an embedded URI that redirects to a URL associated with phishing and malware distribution. The ML classifier and ClamAV detection strongly indicate maliciousness, likely for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=toro+lawn+master+2+manual
    • https://cdn.sqhk.co/posukomokufi/PbHljcN/17740901264.pdf
    • https://cdn.sqhk.co/luridixajix/b3icibW/autograph_movie_songs_._com.pdf
    • https://cdn.sqhk.co/mipekakiri/Cggngfm/vabupafuraxetovobifux.pdf
    • https://cdn.sqhk.co/wufevinek/ijhfggp/cash_app_says_debit_card_not_supported.pdf
    • http://jalazekesofijot.medianewsonline.com/zawiminamuvebadigibito.pdf
    • https://cdn.sqhk.co/mozoposowi/hckhhzr/furefeziwuw.pdf
    • https://cdn.sqhk.co/tajixixejafi/jfihJhe/lexamexigij.pdf
    • https://cdn.sqhk.co/zutujodara/uFlhfig/banque_cantonale_neuchateloise_annual_report.pdf
    • https://cdn.sqhk.co/purawewus/jihajeH/boom_beach_hack_apk_ios.pdf
    • http://dezimazokuxulil.mygamesonline.org/lokuxijoforodevegolota.pdf
    • http://rivilidopu.medianewsonline.com/beatles_songbook_chords.pdf
    • https://cdn.sqhk.co/demanajinu/1gghh2N/89862000682.pdf
    • http://nibakelenixezas.getenjoyment.net/nursery_rhymes_for_babies.pdf
    • http://dusikazo.mypressonline.com/mathematics_important_formulas.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://xomapagovujux.atwebpages.com/bofoki.pdf
    • http://jadivepijuga.myartsonline.com/53685265334.pdf
    • https://s3.amazonaws.com/zopenave/historia_del_escudo_de_costa_rica_para_nios.pdf
    • https://s3.amazonaws.com/mukutud/cat_vs_dog_fight_videos.pdf
    • https://s3.amazonaws.com/pululusodogi/2007_dodge_caliber_sxt_repair_manual.pdf
    • https://s3.amazonaws.com/jivagajamav/ielts_writing_tips.pdf
    • https://s3.amazonaws.com/tetenifeme/65931073554.pdf
    • http://xasagode.myartsonline.com/nsk_bearing_nomenclature.pdf
    • http://wutesejib.onlinewebshop.net/68382120501.pdf
    • http://naranosufok.atwebpages.com/6782789025.pdf
    • http://revudipepofaten.myartsonline.com/wodivozerivubalarefedujug.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d2f0.bin
fbb413f7b0c5ba3067fd3e5455bce90d125ec2f475954d2ec779c59f81b5875e
pdf-font-stream PDF embedded font (sfnt) at offset 0xD2F0 5004 bytes
font_01_sfnt_off0000e3eb.bin
1e3cd49508d9b898786826657409ddd3a7891b38a3b0ae1c1ead91c00e2b5105
pdf-font-stream PDF embedded font (sfnt) at offset 0xE3EB 10564 bytes