Malicious PDF — malware analysis report

Static analysis result for SHA-256 56492373ecef5382…

MALICIOUS

PDF

77.0 KB Created: 2021-04-08 07:17:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3b2f7a7aa3664a9e191b4ca1e9da1235 SHA-1: db3d116196703193d301df8e33ccac510ddc68bb SHA-256: 56492373ecef5382bb7dc9773e33150d085cb34f14f1fa29721b4eda4b5920c2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, which is likely a lure for downloading a malicious payload. ClamAV and ML classifiers strongly indicate this PDF is malicious, specifically flagged as a phishing trojan. The document body, though heavily obfuscated, contains text related to 'Beauty and the beast piano sheet music', suggesting a social engineering pretext to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/strik?utm_term=beauty+and+the+beast+piano+sheet+music+easy+free
    • https://cdn.sqhk.co/xezafube/4iiG7z8/23805833746.pdf
    • https://cdn.sqhk.co/rawerusiwala/jhcbOjf/star_wars_colony_ships.pdf
    • https://cdn.sqhk.co/zirevazul/dWJhzwT/hungry_dragon_all_dragons_skins.pdf
    • http://apsdd54gfv.xyz/diduwuwigomijibusiratmp6a.pdf
    • https://static.s123-cdn-static.com/uploads/4459641/normal_5fee1b7067cc6.pdf
    • http://lnstagram-verifedbadge.com/fall_of_the_eastern_roman_empire_dateng05z.pdf
    • https://cdn.sqhk.co/dunokufimove/igIShhj/video_converter_vob_to_mp4_apk.pdf
    • https://cdn.sqhk.co/vugasoveg/6ifjjDN/81578240918.pdf
    • http://onkoprofi.ru/3959470281937hvi.pdf
    • https://cdn.sqhk.co/zatovafer/MiijjVl/23154641749.pdf
    • https://cdn-cms.f-static.net/uploads/4385850/normal_5fd99dff76cc9.pdf
    • https://cdn.sqhk.co/damukowabij/fxighje/hill_climb_racing_2_challenges.pdf
    • https://cdn.sqhk.co/vixawutozama/ibZhb1l/credit_report_check_usa.pdf
    • https://cdn-cms.f-static.net/uploads/4485163/normal_6020638a74968.pdf
    • https://cdn.sqhk.co/xijogedobu/hcDggQg/95078711746.pdf
    • http://italysummer.fun/69562044338drcbv.pdf
    • https://cdn.sqhk.co/fujalapevame/RggqqQU/endocarditis_guidelines_ppt.pdf
    • https://cdn.sqhk.co/niripakexad/WjjJriy/17263982483.pdf
    • https://cdn.sqhk.co/vobevufubito/ggLcgde/real_time_voice_changer_lite_apk.pdf
    • https://static.s123-cdn-static.com/uploads/4366340/normal_5fce32d0ef4e6.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/e4716dc4-4921-4c01-a459-1075c4981542/jan_m_rabaey_digital_integrated_circuits_download.pdf
    • https://uploads.strikinglycdn.com/files/6c99f645-a69b-4a1e-ad39-f6189b723772/hp_photosmart_d110_printer_ink.pdf
    • https://uploads.strikinglycdn.com/files/c02b4beb-7a20-419e-9c62-c8c1450a26d9/45929931602.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ebcd.bin
fa5a0bd748123965d516d729a260335c5876c906c77687e308fde07448c39c88		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEBCD 5652 bytes
font_01_sfnt_off0000fee6.bin
7d72f77307f64b52de4ca0ff1d2a80c1a4d9757daa12fdaf424f732b5a6c706f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFEE6 11528 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.