Malicious PDF — malware analysis report

Static analysis result for SHA-256 54a225647d139a52…

MALICIOUS

PDF

105.3 KB Created: 2021-03-17 07:58:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 37ade9842dd031973b175444213868fb SHA-1: dcb54bffbc1ebc0a10bdd26da5a8015bb575652f SHA-256: 54a225647d139a520ed44c54109879762d1f360259f1acccc9ad828650258540
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. An external URI, https://leonvi.ru/award?keyword=skripsi+akuntansi+keuangan+kuantitatif+pdf, was extracted, suggesting a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains metadata related to wkhtmltopdf and a date, indicating it was likely generated programmatically to appear as a legitimate document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/award?keyword=skripsi+akuntansi+keuangan+kuantitatif+pdf
    • https://static.s123-cdn-static.com/uploads/4459787/normal_5fef8e708a1e1.pdf
    • https://cdn.sqhk.co/tiviluluje/ezcfhgu/vinaxozux.pdf
    • https://jijaxiwiruba.weebly.com/uploads/1/3/5/3/135333012/degupup.pdf
    • https://cdn-cms.f-static.net/uploads/4446377/normal_60374aff3b476.pdf
    • https://virigegeke.weebly.com/uploads/1/3/2/7/132740897/4272883.pdf
    • https://cdn.sqhk.co/bikezuku/k9oqlLX/dilanedixodawubukon.pdf
    • https://cdn.sqhk.co/ruzemesafe/avKWME3/nogarabudiwabegotu.pdf
    • https://kutijodokijo.weebly.com/uploads/1/3/4/7/134706590/genirokawosuw_turosona.pdf
    • https://cdn.sqhk.co/ruzewekafan/zjadwhd/game_fx_racer_free_mod_apk.pdf
    • https://cdn.sqhk.co/fefowofuk/hcgdpVj/89395200606.pdf
    • https://bimelubisazabe.weebly.com/uploads/1/3/4/4/134492892/jamapaberijovoza.pdf
    • https://cdn.sqhk.co/zukasedu/ij0Yggb/star-_skateboards_vintage_cruiser_board.pdf
    • https://zutuvibob.weebly.com/uploads/1/3/1/4/131407898/lerurakoro.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/fb419531-55aa-42dc-904b-36601d38bfce/32543868362.pdf
    • https://s3.amazonaws.com/veledabejufi/40844136930.pdf
    • https://uploads.strikinglycdn.com/files/f6d77fcc-9720-4636-b52b-7b6c914a15d0/diy_3d_printer_designs.pdf
    • https://s3.amazonaws.com/dagasopones/9048395264.pdf
    • https://s3.amazonaws.com/jeduzizonox/winofinil.pdf
    • https://s3.amazonaws.com/ronatiduzoxij/android_phones_under_30000_in_nigeria.pdf
    • https://s3.amazonaws.com/wajibile/zozuxiripegapinamobemives.pdf
    • https://uploads.strikinglycdn.com/files/3052906e-44cf-46cb-a4fc-b6aef890aeb2/sujisadalanuvokonijo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00015502.bin
f9f26df324639b85be677d715800b250e38fe897fa4b4a1e129435fe92c89d09		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15502 5116 bytes
font_01_sfnt_off0001666b.bin
63b0e86f978fb2f4a53d9f1efb9c1699bedba82bf9a32194c31e816f85a6db9b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1666B 10232 bytes
font_02_sfnt_off0001894b.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1894B 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.