Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e07bba590ca2668…

MALICIOUS

PDF

69.3 KB Created: 2021-04-03 14:34:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4ecaa18272b8d3163b37f5fdf834eb1a SHA-1: 32d4d8d346c5c78de0290f2369d98260aa5f48d5 SHA-256: 4e07bba590ca2668a328d60f473384bb262fa5f343812b42ea040a2a8970fbd7
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that leads to a phishing site. The document body, though heavily obfuscated, suggests a lure related to a car manual. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/123?utm_term=used+manual+acura+tlx+for+sale
    • https://vubeluzuge.weebly.com/uploads/1/3/4/3/134357782/1fa23efff.pdf
    • https://cdn.sqhk.co/vavetiset/jj7haih/timeline_maker_template_word.pdf
    • https://cdn.sqhk.co/xibidodoko/dgdXvgf/chicken_shack_band_christine_perfect.pdf
    • https://cdn.sqhk.co/jilowepe/jeNhd7r/14665474536.pdf
    • https://wozijasobinela.weebly.com/uploads/1/3/4/4/134445001/wepadodezovutik.pdf
    • https://cdn.sqhk.co/kopilixa/fyZijqI/xonidolameverudi.pdf
    • https://gadebalemalun.weebly.com/uploads/1/3/4/4/134443756/eda87f4918cad.pdf
    • https://cdn.sqhk.co/kavuweduti/EgiwdwE/navy_housing_san_diego_hot_sheet.pdf
    • https://vugadeji.weebly.com/uploads/1/3/1/4/131406436/vudemixelilutesi.pdf
    • https://cdn.sqhk.co/ridefapagol/mje5Njd/card_games_online_free_with_friends.pdf
    • https://radogatibemif.weebly.com/uploads/1/3/2/8/132815767/jatiletu.pdf
    • https://cdn.sqhk.co/bemaxopig/zigiDzd/siwakaneb.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/jipowumat/83340697005.pdf
    • https://uploads.strikinglycdn.com/files/977c7ecb-5c92-4cd5-8008-0fc45596601a/mogepoweg.pdf
    • https://s3.amazonaws.com/bulalowisu/38569577594.pdf
    • https://uploads.strikinglycdn.com/files/77fb9353-b039-4827-b9d7-de700bf6cd16/14702957378.pdf
    • https://uploads.strikinglycdn.com/files/927a13eb-782c-4813-a622-db07263387a9/24410325753.pdf
    • https://s3.amazonaws.com/fotepopunaj/44861445942.pdf
    • https://s3.amazonaws.com/jipowumat/89901529763.pdf
    • https://s3.amazonaws.com/rerinago/murdered_soul_suspect_wiki_guide.pdf
    • https://uploads.strikinglycdn.com/files/9a7d0202-1a49-4282-9b21-fbbec578438c/97297859975.pdf
    • https://uploads.strikinglycdn.com/files/f96f5246-4340-42ad-8e7d-3a6481fc5f31/hotpoint_gas_range_oven_igniter.pdf
    • https://uploads.strikinglycdn.com/files/dd42e44f-b6b7-45de-aa87-fd5c4e1b0e1d/roland_d50_software_synthesizer.pdf
    • https://uploads.strikinglycdn.com/files/7e82b1e3-629c-4f35-9ff6-e6e86dbdc15b/hegelian_dialectic_prodigy_download.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d2c8.bin
4c5629aa1f21ffdbe8be7d79cbeee58655f430d84c4656a375ffff54f58fb74b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD2C8 5224 bytes
font_01_sfnt_off0000e479.bin
5a321a81516fbffd64a58c6b0b90ed053867b7f8399dc0b97eba8020d4cc9dfa		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE479 10248 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.