Malicious PDF — malware analysis report

Static analysis result for SHA-256 55a12283e030cfe2…

MALICIOUS

PDF

146.9 KB Created: 2021-03-18 09:27:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f4fad3bc1d61141707b7fce00bae83a0 SHA-1: 13a51a3eb9f8a7b717c6315bb2e8a70c62f7feb3 SHA-256: 55a12283e030cfe2686ddc8940d1302698dcc0ae715cbcb3abac243e9f4d9783
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://pelibifir.ru/123?utm_term=chakma+old+song', which is likely a phishing or malware distribution URL. The document body, though heavily obfuscated, suggests a lure related to a 'Chakma old song'. No scripts were extracted, but the presence of external URIs and the ML/ClamAV detections strongly suggest an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/123?utm_term=chakma+old+song
    • http://lapitubemexidi.mywebcommunity.org/49975932540.pdf
    • http://tranquils.space/kenmore_dishwasher_ultra_wash_quiet_guard_4_resetewmkq.pdf
    • http://nezowigivomi.scienceontheweb.net/sojivowud.pdf
    • http://foxilajat.sportsontheweb.net/non_biodegradable_plastic.pdf
    • http://luxasireku.sportsontheweb.net/rufabimitogatujijezirek.pdf
    • http://dkblogin-de.com/pere_ubu_final_solution_meaningrc82w.pdf
    • http://jukojadijomefar.medianewsonline.com/station_mto_vantage_vue_-_6250eu_-_davis_instruments_avis.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/welanisowari/top_collage_maker_app_for_android.pdf
    • https://s3.amazonaws.com/luramamelolem/sexufavijorelufaw.pdf
    • https://s3.amazonaws.com/mupukesunobaga/halloween_word_search_middle_school.pdf
    • https://s3.amazonaws.com/vexeliku/bfuhs_practical_date_sheet_2019.pdf
    • http://sasaxunofob.atwebpages.com/direvuvolapikagepexigu.pdf
    • https://6e37e838-c278-4d46-baa9-25b8497af200.filesusr.com/ugd/fbcb80_b4d1a82003e143808eb0a9ad194b95df.pdf?index=true
    • https://s3.amazonaws.com/rokuwapesu/44587897699.pdf
    • https://dbba0f06-1911-40f0-8c80-a2638c7f81cc.filesusr.com/ugd/b13fd1_268c7d2af17445e3a17a4c0ff4d33042.pdf?index=true
    • https://680e7e7f-99bb-4309-8a01-ecc910dc7690.filesusr.com/ugd/717a42_d215e6700bfb4fe692880ea5ea0befdc.pdf?index=true
    • https://72b50e20-f79f-40ca-96b4-24bef83e308f.filesusr.com/ugd/1a1092_93eecd2ba11744eb99ad4992ce5639be.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00011fe0.bin
681733430da20ddfc372b96573f41efe8dbf93817eb013474bd9e39b2b5487e0		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x11FE0 67864 bytes
font_01_sfnt_off0001e9d2.bin
faf28291db3a35517e89e92609324f8e1a317b27c787be8375d3443aca85ade7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1E9D2 5112 bytes
font_02_sfnt_off0001fb0e.bin
6c5a05ab09b382844cc73c11153e62eb7f7ef00b837c4c2a103d9cc7a895258b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1FB0E 15656 bytes
font_03_sfnt_off000228e3.bin
fbdc905918934bb14f99f3f16c6e87e7bf0db5b1ec9dce6803c569451e9c8458		 pdf-font-stream PDF embedded font (sfnt) at offset 0x228E3 16116 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.