Malicious PDF — malware analysis report

Static analysis result for SHA-256 5690b9a10d27ffd3…

MALICIOUS

PDF

75.5 KB Created: 2021-03-20 22:23:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 447b72667cae363203dd9ae0b04c34e1 SHA-1: 88b7824e19dd1734739bd865a96482856c59536d SHA-256: 5690b9a10d27ffd33b8475fb4c03dee2c9d51485c9fce1f27335df21d5b0c444
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains embedded URLs, one of which is identified as malicious by ClamAV and an ML classifier. The document body, though heavily obfuscated, suggests a lure related to chart songs. The presence of embedded URLs and the malicious classification strongly indicate a phishing or malware distribution attempt, likely using a spearphishing attachment vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://pumaguli.scienceontheweb.net/96829680289.pdf
    • https://cdn-cms.f-static.net/uploads/4368227/normal_602fe6aaf3efa.pdf
    • https://cdn-cms.f-static.net/uploads/4486548/normal_6035cb67b782a.pdf
    • https://bifupepazabar.weebly.com/uploads/1/3/4/7/134740405/nawanamenule_gituwiguta_figodamofil_wetomowu.pdf
    • http://kepukarob.sportsontheweb.net/meditations_marcus_aurelius_free.pdf
    • http://janizejekifajab.medianewsonline.com/review_articles_on_anticancer_drugs.pdf
    • http://tinubawolu.mywebcommunity.org/20939909836.pdf
    • https://cdn-cms.f-static.net/uploads/4482426/normal_5fd22a4ccb5f5.pdf
    • http://kawibijew.22web.org/is_the_sims_3_pets_backwards_compatible.pdf
    • http://towexiwi.sportsontheweb.net/lenovo_thinkbook_13s.pdf
    • http://goodsun.space/xuvaderexuwakuvibon04xi2.pdf
    • http://fulifubajamo.mywebcommunity.org/auditoria_financiera_forense_donaliza_cano.pdf
    • https://fejilexa.weebly.com/uploads/1/3/1/1/131163980/foxadeniwexizatos.pdf
    • https://vilawamilufulob.weebly.com/uploads/1/3/6/0/136006615/nagov.pdf
    • https://static.s123-cdn-static.com/uploads/4449410/normal_5fce7b22df3ee.pdf
    • https://cdn-cms.f-static.net/uploads/4481397/normal_6009b81fc6d7e.pdf
    • http://wipunemobak.mygamesonline.org/how_much_money_do_you_make_as_a_twitch_affiliate.pdf
    • http://allieshouseofhope.com/94393092032quf7h.pdf
    • http://duxinivodozular.mywebcommunity.org/patitaxilipejuzibulefam.pdf
    • http://voicebftyi.com/69821414098a000a.pdf
    • http://kapijozorok.22web.org/acgih_industrial_ventilation.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://feedproxy.google.com/~r/wb/ENAH/~3/3IgsHNHpEfs/wb?keyword=top%20hundred%20chart%20songs
    • http://mulapoxe.onlinewebshop.net/obc_sub_caste_list_in_west_bengal.pdf
    • http://guvipum.epizy.com/39292420838.pdf
    • http://pojozija.onlinewebshop.net/walking_dead_graphic_novel_193.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e6d8.bin
1a16b236dd1c385e1c155478f14753da6800483582ae126a085ab8e584c91f0d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE6D8 5252 bytes
font_01_sfnt_off0000f8ad.bin
a77ba57c51f2c60f498cab99a8ade3b61b0f11f5a627cd0e392c8fe4c3df751c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF8AD 11252 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.