Malicious PDF — malware analysis report

Static analysis result for SHA-256 54278d8c5a305850…

MALICIOUS

PDF

67.7 KB Created: 2021-03-26 01:15:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: 58fbbfaadd97909a413d300b25c86838 SHA-1: 44094acad3b276c78319411e84a7c7a14f4e2fb7 SHA-256: 54278d8c5a3058504b172891442e83aa7cd46369c48fc2b97cd53eb926f80465
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ML classifiers and ClamAV. It contains an embedded URI pointing to 'xezojetit.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, and the presence of multiple embedded URLs indicates an attempt to redirect the user to malicious content. No scripts were extracted, but the overall structure and heuristic firings strongly suggest a malicious intent to trick users into visiting a compromised URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/123?utm_term=telugu+movies++hd+print PDF link annotation
    • https://cdn.sqhk.co/gofelaxes/3aQuPgr/pubopa.pdfIn PDF document text
    • https://cdn.sqhk.co/nilesatu/hiQjfjg/formula_crazy_car_racing_fanatical_formula_card.pdfIn PDF document text
    • http://laulu-go.ru/6255218345qv81h.pdfIn PDF document text
    • http://new-leggins.site/fishing_paradiso_mod_apk_2._4._6yby8e.pdfIn PDF document text
    • https://cdn.sqhk.co/raxoxawupej/jihifgc/54880586476.pdfIn PDF document text
    • https://cdn.sqhk.co/pivoledofag/ifOsrz3/platform_games_pc_2017.pdfIn PDF document text
    • https://cdn.sqhk.co/sepolulegaba/5v4Rjjy/lagu_yang_terdalam_lirik_fatin.pdfIn PDF document text
    • https://cdn.sqhk.co/nojebimit/heij6O8/real_car_racing_simulator_mod_apk.pdfIn PDF document text
    • https://cdn.sqhk.co/zenekukera/WiejcSn/blank_name_kik_copy_and_paste.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/8c5c04cd-e907-46fe-8aec-6a613c080170/singular_and_plural_nouns_worksheets_grade_3.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1d67db7d-5026-4e2a-9b1e-9b98fac4ac63/autotrol_water_softener.pdfIn PDF document text
    • https://s3.amazonaws.com/wizuluworafid/rozananixejiwopukelonego.pdfIn PDF document text
    • https://s3.amazonaws.com/xonaxevetaf/73961547926.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9d9d2698-800c-4cdc-9446-6ce77bf7e8f4/kegutaruluw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2b30d372-a74a-48c8-b40c-416ace804c1e/32229690586.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c5e345dd-8c7a-48b4-81dd-a2cebcbf9c7e/totobinibegodene.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d23dbb2e-4241-4aac-a672-e92b7cb0dfd3/zuvimegosabox.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/22255ad6-61e9-46e6-bf63-9b5c846d14ed/jusaxoxodilijoxuwizeso.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1fd26228-0e27-445f-9713-0da39a3fe8b7/wakasixukubaraze.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0e6a7f78-803f-4a1c-a91d-a17965644634/sherlock_holmes_1_tamil_dubbed_movie_download_in_isaidub.pdfIn PDF document text
    • https://s3.amazonaws.com/gifiz/ladixalusiva.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cc78.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCC78 5172 bytes
SHA-256: a606cc1da63248f091871c7df68c2d135cc06462b399bcacdea0b1a34ac14fb3
font_01_sfnt_off0000ddef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDDEF 10356 bytes
SHA-256: 4f7f1bb627941e4ec72b72f5a504d9a4c28f58ab0e8b7c93b851183f6dd41254

Open this report in the interactive analyzer, or submit your own file for analysis.