Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e1a1a50c00e7fda…

MALICIOUS

PDF

78.5 KB Created: 2021-05-16 18:29:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: a1a4f778df66bd962b01b944d3b6b177 SHA-1: ecff614f1709fad518b3fceb80648b9c14e03dfd SHA-256: 4e1a1a50c00e7fdaf070c75166b3656d9f2d97ee0aeee54de737d932c6179a89
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The document body, though heavily obfuscated, appears to be a lure related to the US Constitution. The presence of external URIs and the ML classifier's high confidence score indicate a phishing attempt designed to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/strik?utm_term=what+does+the+us+constitution+say+about+education PDF link annotation
    • https://jarowezib.weebly.com/uploads/1/3/0/8/130813985/beburivewifo-gutefumilifade.pdfIn PDF document text
    • http://ing-jobs-opportunities.com/how_do_i_share_a_news_story_on_facebook1go3t.pdfIn PDF document text
    • http://linza.media/muxaxagibunisusoxe939ei.pdfIn PDF document text
    • http://berkeciftci.net/lafowewikebuwutomatoj6x2uk.pdfIn PDF document text
    • https://gopaposoxawa.weebly.com/uploads/1/3/0/7/130740193/9570135.pdfIn PDF document text
    • https://gisixumaxen.weebly.com/uploads/1/3/1/8/131856636/9038107.pdfIn PDF document text
    • http://podarokinsta24.online/vijimamovanetejik655j.pdfIn PDF document text
    • http://save50it.info/html_tutorial_for_beginners_in_tamil6xmh6.pdfIn PDF document text
    • http://lnstagram-helping.live/applied_statistics_and_probability_for_engineers_7th_edition_free_download77hvz.pdfIn PDF document text
    • https://zevigetadafuwun.weebly.com/uploads/1/3/0/9/130969942/sagogotodo_sugetazipig.pdfIn PDF document text
    • http://accueilcmb.com/vaxidudolofe95kqe.pdfIn PDF document text
    • http://spainwow.pro/5033034460417y0.pdfIn PDF document text
    • https://bogekivusuwi.weebly.com/uploads/1/3/4/6/134604255/wekakekufago.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/tobaziw/86526375319.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cb18ae20-29a5-4a37-9926-00059de51796/motorola_cp200_radio_antenna.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7cc68606-1db3-4143-9678-97c1b1af50ff/norton_internet_security_2015_key_free.pdfIn PDF document text
    • https://s3.amazonaws.com/pevuwarobuvowa/game_of_life_quarter_life_crisis_uk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1f333c30-8ce1-4af3-b959-6f5e8b70ab74/vitinaneguparilixunafujur.pdfIn PDF document text
    • https://s3.amazonaws.com/kevava/guide_du_routard_israel_fnac.pdfIn PDF document text
    • https://s3.amazonaws.com/muvarelo/impossible_quiz_2_question_50_answer.pdfIn PDF document text
    • https://s3.amazonaws.com/gedexim/h_k_letter_whatsapp_status_video.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/56e8f96b-9455-45ce-bb02-c1a00cfd42bc/find_the_seventh_day_adventist_church_of_the_oranges.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f499.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF499 5152 bytes
SHA-256: f8fe60505c9057c5dfe7c6015b1f0755c7e66ad19e6f9ab13fbe9f2723ab99bd
font_01_sfnt_off00010632.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10632 10604 bytes
SHA-256: dc08db21660f7ca424ca2295ad4b3cd50a9a1a04a8788956609f48e909637c1b

Open this report in the interactive analyzer, or submit your own file for analysis.