Malicious PDF — malware analysis report

Static analysis result for SHA-256 529f93ffae86cf22…

MALICIOUS

PDF

80.9 KB Created: 2021-04-27 10:23:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 530679a3de60c2f43e96d34a243a82d8 SHA-1: 57a40588c7c04eeb6fa16ba1d7f7971337781acb SHA-256: 529f93ffae86cf229e9d2911b1d4e191c6f2705128f1aab101cb9c0b79e28e82
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains an embedded URL that leads to a suspicious domain, likely intended to host a malicious payload or redirect the user to a phishing site. The document body, though heavily obfuscated, suggests a lure related to improving drawing skills.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=how+to+improve+drawing+quickly
    • http://pumeputokamodo.22web.org/93764871190.pdf
    • http://kataval.22web.org/why_wont_ice_maker_fill_with_water.pdf
    • http://bumefivaloso.scienceontheweb.net/arab_league_organizational_structure.pdf
    • http://zodagudego.iblogger.org/bediwofexejagitedodet.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/tidigudetefumof/sony_bravia_tv_manual_2012.pdf
    • http://kosezofejesuxef.atwebpages.com/atlantis_legend.pdf
    • https://s3.amazonaws.com/fadupazageraf/authors_purpose_pieed_anchor_chart.pdf
    • https://s3.amazonaws.com/gapivegek/metobozatixavefola.pdf
    • https://s3.amazonaws.com/jivamubug/xuzitujivak.pdf
    • https://uploads.strikinglycdn.com/files/19b5e049-4ac5-484e-91ee-702aebc4cb50/explain_the_advantages_of_child_centered_approach_to_teaching_and_learning.pdf
    • https://uploads.strikinglycdn.com/files/f3f10221-47d7-4f7b-89ae-ca5f81fdba9d/96218741490.pdf
    • https://s3.amazonaws.com/dobikasukavu/kununoxot.pdf
    • https://s3.amazonaws.com/wolawatin/gemisozu.pdf
    • https://uploads.strikinglycdn.com/files/1b3503c3-9ba5-44a6-bf8f-92484120b668/6032022875.pdf
    • http://biranon.rf.gd/haynes_carburettor_manual.pdf
    • https://s3.amazonaws.com/fukepez/union_pipefitter_salary_texas.pdf
    • https://s3.amazonaws.com/pewebopufupe/zosomikeripevatazexiz.pdf
    • https://s3.amazonaws.com/xipavir/side_by_side_atv_1000cc.pdf
    • https://s3.amazonaws.com/mekonulegipero/ssc_nwr_mts_answer_key.pdf
    • http://wedizakur.epizy.com/nanajutatupodinomavep.pdf
    • https://s3.amazonaws.com/mamukawaxatali/guide_gravure_verres_progressifs.pdf
    • https://s3.amazonaws.com/wozoxub/printable_2nd_grade_math_worksheets_counting_money.pdf
    • https://s3.amazonaws.com/nitidadufetenu/wh_1000xm2_vs_xm3.pdf
    • https://s3.amazonaws.com/xozeb/imagen_de_medios_de_comunicacion_antiguos.pdf
    • https://s3.amazonaws.com/pirofopafu/where_the_wild_things_are_book_quotes.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fe72.bin
cbd0cf6dfcd1442e17cd3ea7e923f9296e71182772e6dae5650a8f8d348a0f8f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE72 5620 bytes
font_01_sfnt_off00011198.bin
d95fd99f73ea044a5dd0b82c31201b2def202c1a4d741cc3ce9722e55dc3e4b6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11198 10656 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.