Malicious PDF — malware analysis report

Static analysis result for SHA-256 4fbdb3e7a8d2a0e5…

MALICIOUS

PDF

78.4 KB Created: 2021-05-21 05:37:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 364cdab8e979131dd2601cdb9b639cee SHA-1: 2e30b57f42ffb6f16ffbd222c4fab3318742189e SHA-256: 4fbdb3e7a8d2a0e5310e9262ab066e25696eec8f07ef21d398297e84d82c25f3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL, which is a common tactic for phishing and malware distribution. The ML classifier and ClamAV detection strongly indicate maliciousness. The embedded URL likely leads to a malicious site designed to exploit the user or deliver a payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/strik?utm_term=homogeneous+linear+differential+equation+with+constant+coefficients+examples+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4456666/normal_603ebb196c546.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365636/normal_600c9a6b6b0fa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4385437/normal_601e5d510995e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/a55da1da-6a18-4a97-a9af-ff1c99bace3d/sokovigojowunudivelupul.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/47b842e9-b205-4e1a-a82b-445da10da33a/encountering_the_old_testament_3rd_edition.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3c4e936f-157f-4ccf-a758-0a98e4e0bf63/funogasolewelopixigi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6f849522-cb74-4d88-9c45-b242872dd48b/2013_vw_jetta_2.5_se_owners_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/gopuze/kolafituvefifug.pdfIn PDF document text
    • https://s3.amazonaws.com/winumigutam/little_red_riding_hood_original_story_author.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/459928e6-b3d1-4486-9832-47f29c9781dd/multiplication_chart_1-30_printable.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ec3a6f80-ad2f-4c3f-baf1-943c91b5ceea/house_of_night_08_awakened.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aa434f09-8f8d-48ed-bdfa-fbcd6ac3728d/kifewawibojesugakozege.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4161aaa8-f0e4-403c-ac65-2e44c736a55e/fososizazavifibe.pdfIn PDF document text
    • https://s3.amazonaws.com/rovikibixu/how_to_connect_bluetooth_on_jvc_kd-s79bt.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/97353034-143b-48e8-a48b-abad8c1afc0f/wasokikebodizogerukugoda.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/79e1c49a-c106-4602-96ec-1637e8d99872/74374049606.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1e1c0600-5366-4e84-8759-c48c86951a31/86424449449.pdfIn PDF document text
    • https://s3.amazonaws.com/bawalidamovidud/bigeninujusuwukubawakigu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0a5fd5f9-7c32-4360-89aa-ae79b3069556/karomif.pdfIn PDF document text
    • https://s3.amazonaws.com/kalanejaxutilif/57605800975.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1e38f754-b39d-4abd-9c9e-a576019b6196/bose_wave_radio_3_bluetooth_pairing.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d9bc7f28-ef71-4200-9367-37496e76a551/12496987615.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7618c7fe-6902-45a3-ab05-d91cdce1f170/plato_republic_book_3_music.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ef1e2757-9012-4fcb-a8c0-c4a84bb5325a/samsung_ml_2165w_installation_software_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dfc65a17-d815-43ab-8e1f-70a05af3e72e/real_heart_drawing_easy.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f235.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF235 5816 bytes
SHA-256: fa9b535d752eb5a8085ba4a190dadf51f26e3f4f95b7b6726771d63016fee896
font_01_sfnt_off000105eb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x105EB 10992 bytes
SHA-256: 7157e60084f7a44350744980f1689b59a2b3d5c9d5e4e53fe8ffc6393a7880ee

Open this report in the interactive analyzer, or submit your own file for analysis.