Malicious PDF — malware analysis report

Static analysis result for SHA-256 4ea6afc11ac85f72…

MALICIOUS

PDF

109.9 KB Created: 2021-04-07 01:02:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 54a586704e2ca450a52dadcd0ed6289c SHA-1: 928dcf2ee3515f4f18889cb291e090e37b0c0aca SHA-256: 4ea6afc11ac85f729583aa60b918eda401e6446d847c4899f15bde16fbadd551
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. The embedded URL, https://pelibifir.ru/strik?utm_term=you+win+in+the+locker+room+first+summary, strongly suggests a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and embedded URLs indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=you+win+in+the+locker+room+first+summary
    • https://cdn.sqhk.co/ninivaxibab/ibORido/49735971018.pdf
    • https://static.s123-cdn-static.com/uploads/4412159/normal_5ff2b43833897.pdf
    • https://kusebavizekofuk.weebly.com/uploads/1/3/4/0/134098677/vogoziwe.pdf
    • https://cdn-cms.f-static.net/uploads/4487927/normal_604ad9841e0e1.pdf
    • https://cdn.sqhk.co/bijowiroma/x0Uhcib/figagusolevuxajiwasuj.pdf
    • https://xeludopoveju.weebly.com/uploads/1/3/4/5/134528604/87aad9.pdf
    • https://vorevowupi.weebly.com/uploads/1/3/4/6/134633589/2167560.pdf
    • https://static.s123-cdn-static.com/uploads/4418191/normal_600481c3b31b7.pdf
    • https://zefowuji.weebly.com/uploads/1/3/4/0/134096403/putoxomofiba.pdf
    • http://55571.ru/how_to_make_freckles_go_away_with_lemon_juicentr3b.pdf
    • https://cdn.sqhk.co/dasisogi/i7cywCT/zozumodimagefugewilekeze.pdf
    • http://salestore.pro/773408535363yvng.pdf
    • https://xemibunadagom.weebly.com/uploads/1/3/4/6/134639404/vadine-zolabasokafoxom.pdf
    • https://cdn.sqhk.co/powurejur/cjcceRr/ffxiv_character_profile_generator.pdf
    • http://kufafukedexepix.mygamesonline.org/87125943553.pdf
    • https://cdn-cms.f-static.net/uploads/4366042/normal_5fdc681a910b9.pdf
    • http://helplnstagramcontact5087423.com/berevawelixaribpeoc.pdf
    • https://static.s123-cdn-static.com/uploads/4408976/normal_5ff7a70389cc5.pdf
    • http://fanisore.sportsontheweb.net/download_ableword.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://sotilijiminariw.rf.gd/human_breathing_system.pdf
    • http://sogilotewi.rf.gd/12396009960.pdf
    • http://rifasufemufogow.epizy.com/nespresso_delonghi_lattissima_pro_manual.pdf
    • http://zimefiji.rf.gd/rikobew.pdf
    • http://raxegujanamefas.atwebpages.com/76396311513.pdf
    • http://kotixetoxuxosa.epizy.com/39438699876.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fe59.bin
929af9c9019cf29bb17ec59107c3ba72c49e9a9feeab384c38b24f17abe3575f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE59 38948 bytes
font_01_sfnt_off0001756d.bin
fb117208321515d5e3e5cd9a16db6b26eeadb2bdfa9725fd42b075c59f78b1a1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1756D 5340 bytes
font_02_sfnt_off00018786.bin
19819eb5e951cbe27421291f8fc1228966d710510d0ee39998c55a93c21fc39b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18786 9956 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.