Malicious PDF — malware analysis report

Static analysis result for SHA-256 5641f240217904eb…

MALICIOUS

PDF

72.9 KB Created: 2021-06-03 11:48:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: 50578b16a10e3e55a4904060907d11f4 SHA-1: 3f21470fa4eab7b6c25ab97118e6af526f632348 SHA-256: 5641f240217904eb149f68713ee4eb4416e3e9cab93280d8b0b2a87a73ecf317
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. An external URI heuristic points to the URL 'https://queure.ru/pbw?utm_term=no+in+different+languages+meme', which is the primary indicator of compromise. The document body, though heavily obfuscated, contains text related to 'No in different languages meme' and application metadata, suggesting a lure to disguise the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://queure.ru/pbw?utm_term=no+in+different+languages+meme PDF link annotation
    • https://static.s123-cdn-static-d.com/uploads/4391954/normal_60b51a46c3118.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446635/normal_5fd1dadaa0a1d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378382/normal_6032f2a3135dc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4427793/normal_5fd603099a483.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4483851/normal_6026f1129892d.pdfIn PDF document text
    • https://static.s123-cdn-static-d.com/uploads/4443594/normal_60b1c38398512.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471710/normal_606e72a152a6d.pdfIn PDF document text
    • https://static.s123-cdn-static-d.com/uploads/4425506/normal_60b3593a50a38.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://letonepamusi.pbworks.com/f/33458020385.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/abf82f39-9e97-4a34-af4c-f013b1b71cd8/panasonic_microwave_repair_vancouver.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/40cedc95-8dd5-4373-9ffe-e76097a2ed59/what_is_the_best_japanese_rice_cooker.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/849079cf-4262-4097-93f0-07254c2df313/describe_a_lake_view.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/33e93ae0-bdcf-49b9-a359-c0ef90114fbb/how_to_unfreeze_a_mini_fridge.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1dc58c77-b34b-45b9-990a-425f40bc8c8a/what_is_rhythm_in_design_principles.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4630005a-85d4-4b58-9942-5b5c026f37ce/natenakekeli.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f417ba4c-5aef-44be-9ba5-8099d0b5af46/how_to_put_paper_in_a_sharp_xe-a106_cash_register.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cf95089e-997f-46c2-a83c-872580342c1e/who_is_the_richest_storage_wars.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ac3f096b-6e7f-4a66-af5a-9707f0343137/74048818709.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6327639d-f266-48e1-97a6-e62f3bb842d8/93117608001.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c76f3a86-67dd-4f6d-9276-5c094224adb7/ranufewogitetatamokimiluv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4216b2f2-7cbc-47eb-a41c-eff9623803f3/galusopinuraj.pdfIn PDF document text
    • http://kakexigodelo.pbworks.com/w/file/fetch/144544473/audi_a4_b9_mmi_navigation_update.pdfIn PDF document text
    • http://sozakuvepar.pbworks.com/w/file/fetch/144498135/dobumudixu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fc49ee71-b2e6-49fb-8a25-b11954977c1f/modelo_atomico_de_bohr_cloro.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e0bc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE0BC 5196 bytes
SHA-256: 6866c81e2937a451c47927e115aa1bb6b55da70bb39bdb19a7c64ac8c516cc59
font_01_sfnt_off0000f259.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF259 9992 bytes
SHA-256: 4ececdebca7bcf0dee234a638c9e741b7f4f9e559da48e07135551371d553dbb

Open this report in the interactive analyzer, or submit your own file for analysis.