Malicious PDF — malware analysis report

Static analysis result for SHA-256 52b08d85cc9bc510…

MALICIOUS

PDF

74.5 KB Created: 2021-03-16 06:31:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a56093e8a1640f8d86cf3a2e75a82b91 SHA-1: 2d776da0bc461c4005cf56ac8707995133d3d646 SHA-256: 52b08d85cc9bc5103d595b8e1ee42a8c7734762f9dba48b005be2ea98f1aa9bd
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI that mimics a search result for a product manual, likely as a lure. Multiple other URLs are present, suggesting a phishing or malware distribution campaign. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or trojan delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=smartparts+digital+picture+frame+spx8+manual
    • http://doucheapp.xyz/soar_se_caen_los_dientes_de_abajokmj49.pdf
    • http://xelamoxadavas.mywebcommunity.org/nojuzaseremiwinivixasamo.pdf
    • http://zemojuvasu.iblogger.org/how_to_reset_a_moto.pdf
    • https://static.s123-cdn-static.com/uploads/4495413/normal_5feeede5d8f70.pdf
    • http://andyhong.blog/moonwalks_by_magic_world_shrewsbury_ma_015455oo4a.pdf
    • http://jalazekesofijot.medianewsonline.com/sntomas_de_autismo_en_nios_de_2_a_3_aos.pdf
    • http://itanto.space/82129447989ilmhz.pdf
    • https://cdn-cms.f-static.net/uploads/4494165/normal_601e9a2e310d4.pdf
    • http://love-your-lips.online/best_alternatives_to_aeron_chair7o1xh.pdf
    • http://manuximaxemeje.scienceontheweb.net/persuasive_essay_topics_for_middle_school.pdf
    • http://golivexi.22web.org/how_much_are_water_picks_at_walmart.pdf
    • http://fofesivolu.iblogger.org/red_eared_slider_turtle_pet_guide.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://japinoxizidunub.myartsonline.com/petroleum_production_systems.pdf
    • http://bujetazufukuv.rf.gd/bodyguard_movie_mp4.pdf
    • http://tujevudaxuxos.epizy.com/79049858770.pdf
    • http://puloxivomavari.epizy.com/android_tv_bluetooth_remote_pairing.pdf
    • http://wiwosotu.myartsonline.com/59614900974.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e3ba.bin
bd2705cab27e3f90521a63e01f85cb6a0b4d485229a36c7cd060267d9b89c6ff		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE3BA 5840 bytes
font_01_sfnt_off0000f788.bin
c05336d5c5f23f935019ddd10fedb08fc73c9ff28e9fadfc3e48e3c34bb8cf55		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF788 10496 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.