Malicious PDF — malware analysis report

Static analysis result for SHA-256 50a69f1fb24d2368…

MALICIOUS

PDF

75.7 KB Created: 2021-04-28 01:23:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4fe5d72e9e04d20acabf978a1c025c47 SHA-1: b69c384bd913f07bfa07187e3d007e5092dc6e27 SHA-256: 50a69f1fb24d23688cc750046b331f0a2943d7b239268fe244f594e8147d2950
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document detected as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site. The document body, though heavily obfuscated, suggests a lure related to vehicle sales, which is a common tactic for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9960

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=2004+dodge+ram+1500+for+sale+ontario
    • http://mitimewigupito.mypressonline.com/kinumogisosenovur.pdf
    • https://cdn.sqhk.co/lupobikud/jhqgggF/alone_marshmello_lyrics_download.pdf
    • http://jozipuvuwuzaj.mywebcommunity.org/82262762350.pdf
    • https://cdn-cms.f-static.net/uploads/4368244/normal_601e291c93de5.pdf
    • https://cdn-cms.f-static.net/uploads/4404503/normal_6066412bdda88.pdf
    • http://maxuruz.22web.org/gorareredaziketana.pdf
    • https://static.s123-cdn-static.com/uploads/4460076/normal_60066fdadbaa8.pdf
    • https://cdn.sqhk.co/wubunepan/rHihL9F/dafewodako.pdf
    • http://joritirumag.mypressonline.com/rosakisan.pdf
    • http://lazokiwumemo.mygamesonline.org/powered_by_the_apocalypse.pdf
    • https://cdn.sqhk.co/rapovebakeb/8w9xhcM/hills_of_steel_3.pdf
    • http://gebikomuxe.getenjoyment.net/food_and_beverage_menu.pdf
    • https://cdn.sqhk.co/ragojagef/5geDij6/7231884542.pdf
    • https://static.s123-cdn-static.com/uploads/4495262/normal_6003534d50786.pdf
    • https://cdn-cms.f-static.net/uploads/4485165/normal_603e2af30d8d7.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://7ef5d8b8-74ac-4e0a-b0a0-fa61ca6462a8.filesusr.com/ugd/23e9be_2e36d92be3c3413abbf4032038bfa7b1.pdf?index=true
    • https://s3.amazonaws.com/tibitexil/vawove.pdf
    • https://s3.amazonaws.com/tutasujal/78401831465.pdf
    • http://bivoxubi.epizy.com/81733531039.pdf
    • https://s3.amazonaws.com/fusopoxipo/87873768187.pdf
    • https://s3.amazonaws.com/fomudebipefasu/anuria_definicion.pdf
    • https://19f621d4-ab03-49b5-bf1d-c78de40104d4.filesusr.com/ugd/bc84a3_59141dacab4d47f4abc126c490fcc681.pdf?index=true
    • http://xikepidefam.epizy.com/16572092024.pdf
    • http://wupewujivijulo.epizy.com/excel_vba_delete_all_charts_in_worksheet.pdf
    • https://26bfc7ce-baa4-43a1-9280-72312523cbd3.filesusr.com/ugd/5af86b_bbe38168d6c648598bde469486a23806.pdf?index=true
    • https://a4edf7fa-b057-49b5-8014-e5fd436fbef3.filesusr.com/ugd/c8b2c5_6545b58a194b44258a468c0130c6b0b6.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e8df.bin
5dcb256aed4208798029630b53bdd0a79281916eee80a43dbc3febf6acc09336		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE8DF 5672 bytes
font_01_sfnt_off0000fc2a.bin
bd4cca313c17b9b7721c727b78b95874aac073c228790ddbf860dacc11368394		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC2A 10860 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.