Malicious PDF — malware analysis report

Static analysis result for SHA-256 5938f21230f1f6a0…

MALICIOUS

PDF

87.6 KB Created: 2021-04-29 13:14:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b50ed628ce2692cca6d86eea9fe8d2b0 SHA-1: ed7b024cc20b6168f986daaa883d87afe4b03ab3 SHA-256: 5938f21230f1f6a0194a0929f15e6b4c0045f63bd4f900b6e297b6b3ee8e398d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, which is highly indicative of a phishing or malicious redirection attempt. ClamAV and ML classifiers also flagged this PDF as malicious, specifically as a phishing trojan. The document body, though heavily obfuscated, contains text related to a 'Petsafe wireless pet containment system extra collar', suggesting a lure to a fake product page or scam.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=petsafe+wireless+pet+containment+system+extra+collar
    • https://cdn-cms.f-static.net/uploads/4393020/normal_605dfd586f4fc.pdf
    • http://eurozone.pro/mastery_greene_summaryelz2e.pdf
    • http://nelolizavulejuj.medianewsonline.com/97976817691.pdf
    • http://salonly.xyz/14951058585rr0ym.pdf
    • https://cdn-cms.f-static.net/uploads/4384149/normal_60627d9baac06.pdf
    • http://japamawosoj.mygamesonline.org/ketogenic_diet_cookbook_free_download.pdf
    • https://cdn-cms.f-static.net/uploads/4446029/normal_603ae94c5fec7.pdf
    • http://mastericy-chistoty.ru/types_of_sentence_structure6awze.pdf
    • http://sayfelengs.space/xatuxofenogivopek2jnob.pdf
    • https://cdn-cms.f-static.net/uploads/4422385/normal_606e692081018.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/8ba92f2f-1484-41a8-9006-06388b56c849/bmw_e39_dsp_wiring_diagram.pdf
    • https://uploads.strikinglycdn.com/files/ea550e58-0bf9-4ace-b236-302b05923e2c/how_to_sell_property_in_monopoly.pdf
    • https://uploads.strikinglycdn.com/files/6fe81725-066b-4d6c-900d-e261f6790e87/vamemuvuworadul.pdf
    • https://uploads.strikinglycdn.com/files/cc24c63a-113e-4330-8256-c6049174f12f/dewubobegekokulusezix.pdf
    • https://uploads.strikinglycdn.com/files/25c530ef-4118-4d7e-825f-925f42f5a976/anker_ipad_keyboard_not_connecting.pdf
    • https://uploads.strikinglycdn.com/files/681bc3a3-3ceb-4744-842e-c960bfa88977/71339848001.pdf
    • https://uploads.strikinglycdn.com/files/7013e302-a229-449e-989f-08a954fc4ba6/do_the_salvation_army_workers_get_paid.pdf
    • https://uploads.strikinglycdn.com/files/9c542737-7ce3-475b-99d8-8ddd3e9a1ac1/yamaha_kodiak_400_model_years.pdf
    • https://uploads.strikinglycdn.com/files/fa6da08c-942a-4a69-b042-d23fbf2db823/what_is_digital_media_landscape.pdf
    • http://larovitivejel.atwebpages.com/15786364478.pdf
    • https://uploads.strikinglycdn.com/files/f6267501-757f-4117-b8c4-7f60cd8ddbd9/xesodisozurubuwevudijuva.pdf
    • https://uploads.strikinglycdn.com/files/7d802352-2562-43a8-96e4-e083caa9dc36/the_seven_laws_of_spiritual_success_selwyn_hughes.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001134e.bin
d3109f84e40a1446fa2cb36763e5bd846e38a3dccb1989a843d641db826cbc13		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1134E 5424 bytes
font_01_sfnt_off000125cc.bin
03679039792dc134fe1427f7c66f923659ba7a4026ffa8f64a4e90b828c65bc3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x125CC 12680 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.