Malicious PDF — malware analysis report

Static analysis result for SHA-256 523885925406b95a…

MALICIOUS

PDF

195.5 KB Created: 2021-03-27 18:01:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ced459031040cc020a2b94c6e9fc6311 SHA-1: 20514a5c94ec12b4636d74f15a4a0da69f1a96d1 SHA-256: 523885925406b95ac3c3b310743f26a34c456d065f12d2d2239cc301222e0678
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing an embedded URL that leads to a malicious domain, identified by ClamAV as a phishing trojan. The document body, though heavily obfuscated, suggests a lure related to 'Pathfinder feat list pdf'. The presence of embedded URLs and the ML classifier's high confidence score indicate a malicious intent to redirect users to a compromised site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9864

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=pathfinder+feat+list+pdf
    • https://cdn-cms.f-static.net/uploads/4380090/normal_6019193762ada.pdf
    • https://tupokigefadewun.weebly.com/uploads/1/3/4/7/134702618/dilobaxabuzoje.pdf
    • https://static.s123-cdn-static.com/uploads/4391327/normal_5fcf2aad7a343.pdf
    • http://gazizelasama.getenjoyment.net/mips_assembly_language_programming.pdf
    • https://cdn-cms.f-static.net/uploads/4426695/normal_604db258013d9.pdf
    • http://wotedogupowu.sportsontheweb.net/gabuxabid.pdf
    • http://drive4mclaneeffingham.com/969533346917sf9t.pdf
    • http://dodajavux.scienceontheweb.net/julutakinu.pdf
    • http://damvglaz0.xyz/tizasefuraxitvejqx.pdf
    • https://lakerevuko.weebly.com/uploads/1/3/4/6/134654656/gabiginukok.pdf
    • http://fusekimutoxi.sportsontheweb.net/pebulidedurefelixoxuw.pdf
    • https://cdn-cms.f-static.net/uploads/4402032/normal_5fd1d3dc275bc.pdf
    • https://piwusobalusuwav.weebly.com/uploads/1/3/2/3/132303181/xotuwoke.pdf
    • http://vash-fasad.live/mobisarozomegazifoxomxtq5.pdf
    • https://revafabeku.weebly.com/uploads/1/3/4/7/134708131/3cab0a.pdf
    • http://pekibexuvipeve.scienceontheweb.net/conformational_isomerism_in_n_butane.pdf
    • https://cdn-cms.f-static.net/uploads/4502721/normal_601b62c89b519.pdf
    • https://manabuvajej.weebly.com/uploads/1/3/4/8/134847277/65f948d4.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://217ba8a6-026c-4a9e-b1ce-2eadff0a4a08.filesusr.com/ugd/3d7af5_171274bb7a444177b22f4ee393fe559b.pdf?index=true
    • https://5548a280-a194-4776-8019-0e256783c1fa.filesusr.com/ugd/f2c1dc_6fe12f68993c4c29891f7b139cc18ef3.pdf?index=true
    • https://86146b48-cf95-488a-b5a0-22832f4589a6.filesusr.com/ugd/3b4eee_f6f90aeae5654464aa088e9f3519d723.pdf?index=true
    • https://cae2aa39-5014-47ec-b549-0fed73f36d02.filesusr.com/ugd/c8683e_a550d75e0f354ec799cc4b37308b4f80.pdf?index=true
    • https://ee67c5b3-b4d3-4257-b425-af55881d3a68.filesusr.com/ugd/c60da7_30393a284b59420ea6bffad1d8b33a79.pdf?index=true
    • https://6bc61794-ec17-45f1-96eb-8bed4cd57308.filesusr.com/ugd/217b8a_13b43fb0f16145cfa6d3d44decccec00.pdf?index=true
    • https://51bf459c-6b46-41b0-863f-532cf8a77e0d.filesusr.com/ugd/2eedf1_e956c85436714b7e8d4a5ef3be86f020.pdf?index=true
    • https://e20d271a-53e3-41f9-9180-d6cd5f9fd148.filesusr.com/ugd/6cfc61_62c646331de94a49a63e52ee75464ff6.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002c7eb.bin
bd10c040ce702f68895098edfbea503203951291f064e8424c67caae32378092		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2C7EB 5132 bytes
font_01_sfnt_off0002d95c.bin
7745e68f8dc6d551c20a1abbbab76b8042a901500e2f1dd3cc6dc66849660808		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2D95C 11160 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.