Malicious PDF — malware analysis report

Static analysis result for SHA-256 54d4abffd6d09d25…

MALICIOUS

PDF

75.9 KB Created: 2021-03-16 07:53:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2a7a9a1b6eaaf090d9f05920a3433bfc SHA-1: 233601d21ccb714a3084e846d87ffde1335d3702 SHA-256: 54d4abffd6d09d252a91bfe336d4cd499fda1db3297e9b3f45d84e9516c0cb31
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. An embedded URI points to 'https://xezojetit.ru/strik', suggesting a phishing or malware distribution lure. The document body is heavily obfuscated, preventing a clear understanding of its specific content, but the presence of external links and high detection scores strongly suggest a malicious purpose.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=how+to+use+log+table+for+calculations
    • http://voyazh-shina.com/writing_chemical_equations_worksheet_with_answersuqlh4.pdf
    • http://gotosutafizal.iblogger.org/payroll_management_system_project_report_doc.pdf
    • https://static.s123-cdn-static.com/uploads/4475564/normal_5fec1ce85cc46.pdf
    • http://lnstagramverifiedbadge-form.com/wekejepaneligodivam19wx4.pdf
    • https://dudasajaje.weebly.com/uploads/1/3/4/3/134362454/187832f.pdf
    • https://wolixakeju.weebly.com/uploads/1/3/6/0/136002716/nitoxewuz_dinorufupoxojor.pdf
    • https://taxurazuzar.weebly.com/uploads/1/3/4/0/134042721/zopovowupeg_kanotevedawi.pdf
    • http://sdfsdfsdf.shaketorch.com/manoti.pdf
    • https://cdn-cms.f-static.net/uploads/4498645/normal_602653759eed0.pdf
    • https://rukusipaxup.weebly.com/uploads/1/3/2/6/132683367/8763321.pdf
    • http://sirosin.iblogger.org/simple_present_tense_verbs_worksheets.pdf
    • https://cdn-cms.f-static.net/uploads/4393018/normal_5fe6ffe282e9e.pdf
    • https://wirazalalotun.weebly.com/uploads/1/3/0/7/130776536/3be6f055d6.pdf
    • http://vwwv-avito.online/putigigt2rnh.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://sudimomovaw.epizy.com/losing_my_mind_follies_sheet_music.pdf
    • https://uploads.strikinglycdn.com/files/f22a71c5-f13a-4a31-90f3-7cbbe76c591e/2003_honda_civic_lx_repair_manual.pdf
    • https://uploads.strikinglycdn.com/files/1e8c6971-3341-407a-bd6e-8bbe4e26b2ab/can_you_mix_powerline_adapters.pdf
    • https://uploads.strikinglycdn.com/files/52172d03-b91d-4844-9254-9c21c458c4c6/lawn_boy_mower_accessories.pdf
    • http://nopexuwub.rf.gd/vodos.pdf
    • http://vurorevebosexu.rf.gd/a_midsummer_nights_dream_symbolism_essay.pdf
    • https://uploads.strikinglycdn.com/files/75167eca-0c97-4eec-a577-0f2605f04713/loboxomapakip.pdf
    • http://zizinamejukurep.rf.gd/article_35a_in_english_download.pdf
    • http://sonisan.epizy.com/arx_fatalis_character_creation_guide.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e946.bin
b913fbeffef0c77d0ae82e16dd6269d2e2415f1d8c652590c7d06a2783920e9f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE946 5240 bytes
font_01_sfnt_off0000fb41.bin
1ab88ff5507bef20fc90a87b0b94a745c905ba1038f03e7a9cafae08b262f7b8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB41 11428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.