Malicious PDF — malware analysis report

Static analysis result for SHA-256 578f5d66f9db7db5…

MALICIOUS

PDF

87.8 KB Created: 2021-03-16 05:05:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 152fe1e065137a76faa5cfb0e7a4d42c SHA-1: b94684b6919d93fb395abbc970c752c9424bc975 SHA-256: 578f5d66f9db7db5ac434d572b21d9634393be5a0f100175be97c8cbba82992f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, suggests a lure related to a literary work to entice clicks on the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=love+song+of+j+alfred+prufrock+translation
    • https://tobapedez.weebly.com/uploads/1/3/5/3/135344168/pavonuvolagap.pdf
    • http://parhelifrl.space/arabian_nights_ebook_freex5zuj.pdf
    • http://nubolutlion.xyz/fufoxodegogo7749u.pdf
    • http://heleogose.online/theoretical_and_conceptual_framework_in_research_proposal_ppt0bu29.pdf
    • https://karaxofuko.weebly.com/uploads/1/3/5/3/135344752/160624.pdf
    • http://idealica-italiaufficiale.website/sijijkj5va.pdf
    • http://reduslim-official.website/tchibo_cafissimo_classic_bedienungsanleitungvoljt.pdf
    • http://znakomstva69.space/in_the_blink_of_an_eye_book_free_downloads9ojh.pdf
    • http://lorenbayi.com/59776055953zoynn.pdf
    • http://youralteragoods.com/fly_tying_desk_topkdfdn.pdf
    • http://copyrightsupportforlnstagram.com/magic_bullet_kitchen_express_canada8k271.pdf
    • http://brumbum2.xyz/6114636797avo4z.pdf
    • http://klosheff.xyz/biology_books_for_neet_freebyqlz.pdf
    • http://vwwv-avito.online/is_crosley_cruiser_a_good_record_playery8b0w.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/didowugorokirug/air_force_academy_chapel_wedding.pdf
    • https://11f44e1d-c86f-4be6-baa1-90970e7c24f5.filesusr.com/ugd/a298ce_8da74c7a5a5a4333b41de685db03218c.pdf?index=true
    • https://598a1783-db1d-4ebb-96f5-d3ad23e1e090.filesusr.com/ugd/ae99eb_84bb55ecfc8d45ba98de898a164d3477.pdf?index=true
    • https://4eff3ec4-d147-45d1-be73-876d9e1d0019.filesusr.com/ugd/efb3f0_67cf48d7e4dc435ba1f585641cb31fa5.pdf?index=true
    • https://s3.amazonaws.com/vinejivunitego/google_sheets_ipad_fill_down.pdf
    • https://s3.amazonaws.com/liluvad/zigepilu.pdf
    • https://s3.amazonaws.com/farowug/watakusadapepudero.pdf
    • https://s3.amazonaws.com/bisegilupuf/hallucinogenic_plants_a_golden_guide.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011640.bin
dc0dc04e5e16955e0fe5f96c82941e349afa6be35bdad9ce09a21a5e660dedef		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11640 5464 bytes
font_01_sfnt_off00012900.bin
a97bcb18d30d20b8453e5fb8e1c99d99bda1151484f47e64f23a25addfaf47a7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12900 12408 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.