Malicious PDF — malware analysis report

Static analysis result for SHA-256 5594eaafab8801cc…

MALICIOUS

PDF

152.9 KB Created: 2021-04-05 20:27:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7434fee5fa27d353d7dbd5b4d893e8bd SHA-1: 30ff4bffed11c041c51cf8db58091688588c7324 SHA-256: 5594eaafab8801cc975b7e9a5fb422290e4ce375c71a20b86822d6184e21b87f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of embedded URLs, some of which are hosted on suspicious domains, suggests a phishing or redirection attempt. While no scripts were explicitly extracted, the PDF format often utilizes JavaScript for malicious actions, hence the inclusion of T1059.007.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://tababara.weebly.com/uploads/1/3/0/7/130739165/kebagux.pdf
    • https://xifexovajebim.weebly.com/uploads/1/3/0/7/130740184/zolisizutatun.pdf
    • https://cdn.sqhk.co/dewavasese/fijdgdz/46998177701.pdf
    • https://cdn.sqhk.co/xusarukave/jjfFghb/sdg_goal_11_targets_and_indicators.pdf
    • https://sotipazokelaxat.weebly.com/uploads/1/3/2/7/132712266/9101136.pdf
    • https://cdn.sqhk.co/sifajoxojif/9gdrdhc/79170604985.pdf
    • https://cdn.sqhk.co/woleparos/ghhaEGl/xabol.pdf
    • https://jubipolofolexi.weebly.com/uploads/1/3/2/3/132302872/wodav-xikupijatu.pdf
    • https://cdn.sqhk.co/xusarukave/JdgfCgh/18711700382.pdf
    • https://cdn.sqhk.co/xipepovivik/bFdOhgH/food_court_fever_hamburger_3.pdf
    • https://gavufiwi.weebly.com/uploads/1/3/0/7/130775220/rajenoxarozulet.pdf
    • https://cdn.sqhk.co/feguzuvubut/khfrDii/nasexemoli.pdf
    • https://cdn.sqhk.co/kivipemo/gciihgY/luzelak.pdf
    • https://zitadinenere.weebly.com/uploads/1/3/1/8/131871439/5882467.pdf
    • https://cdn.sqhk.co/lesepivir/dNvfhfI/nijumajumoze.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://feedproxy.google.com/~r/wb/ENAH/~3/vAIYpVcV8Aw/wb?keyword=immanuel%20kant%20philosophy%20ethics
    • https://a12a05ab-6462-4855-b086-b0a2a961d6d8.filesusr.com/ugd/2c76f4_72b5b5bae7df41e9a9e65751ad50fac7.pdf?index=true
    • https://9e730ba1-499c-413e-9a09-8a81f8121270.filesusr.com/ugd/0a0016_ef802de9cced44c9a2e0859f934a9c7e.pdf?index=true
    • https://85fc0914-20e3-4f1c-be8c-de7e6f89f47e.filesusr.com/ugd/a44510_7e29f9ac533a4cafad2476593544896e.pdf?index=true
    • https://3c2b787d-8465-4662-bdcc-bf736d584291.filesusr.com/ugd/8760e7_710139cffe5c4afcae69c841a6e71c31.pdf?index=true
    • https://f8d4b294-f952-4a11-85e8-0a3036f9bdaf.filesusr.com/ugd/ad8f3a_d385e10ef88a449a80114ca65b31373f.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00020ee8.bin
250379905e310411876b4cdbbd2b71b3b5578694134fc31cd038f44463a28147		 pdf-font-stream PDF embedded font (sfnt) at offset 0x20EE8 5064 bytes
font_01_sfnt_off00021feb.bin
aaabea4c5e2a59857533b68359ccc4b3a7db6c75720e20f477496745094bfd67		 pdf-font-stream PDF embedded font (sfnt) at offset 0x21FEB 11684 bytes
font_02_sfnt_off00024802.bin
781b9fae2fb9201b4a05d2041fea553bb2973f1d011ab9c51e3326c72e342c60		 pdf-font-stream PDF embedded font (sfnt) at offset 0x24802 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.