Malicious PDF — malware analysis report

Static analysis result for SHA-256 5b674f18ce9b9506…

MALICIOUS

PDF

94.6 KB Created: 2021-03-10 10:47:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 876a7d30af1ea9db743c98a97e8b5aef SHA-1: 7cb8d4ca4c3c59f7c1a20f3c45718fb51d1fcd43 SHA-256: 5b674f18ce9b950687caed81f23554f9e0f361dc97a7c48100b6d405c68e9e79
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that masquerades as a search result, aiming to trick the user into visiting a malicious domain. ClamAV and ML classifiers also flagged this PDF as malicious, indicating a high likelihood of malicious intent. While no scripts were directly extracted, the PDF structure and embedded URI suggest a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/award?keyword=vertex+cover+problem+is+np+complete+pdf
    • http://bidizujimon.getenjoyment.net/94649708258.pdf
    • http://betijeduw.getenjoyment.net/how_to_calibrate_fluke_infrared_thermometer.pdf
    • https://cdn.sqhk.co/wujakegu/lseTibR/classic_cars_auctions_europe.pdf
    • http://nexagufobutuf.22web.org/tizomefagewupim.pdf
    • http://fewomazojuxed.iblogger.org/fisaseruxesosafokujebam.pdf
    • https://cdn.sqhk.co/sixepatexup/fjiQiiC/joker_hd_wallpapers_for_android.pdf
    • https://cdn.sqhk.co/javeduner/4Uiaies/zizuvizisirutemuteg.pdf
    • https://cdn.sqhk.co/sabumijobude/aChjhb6/scary_teacher_3d_for_windows_7.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://mijovutotukedes.onlinewebshop.net/calendar_november_2020_printable.pdf
    • https://55f5e71c-5f54-469f-9449-301c43944234.filesusr.com/ugd/bbdb65_4723a2d6df254925838a666797f72e57.pdf?index=true
    • https://4fe85328-8dbf-40e9-afa8-2c8d6ff8a9c8.filesusr.com/ugd/9c0842_1100f45962754dcda45073391031e355.pdf?index=true
    • https://c504e2ef-f928-4e80-b5b1-fc05046f432e.filesusr.com/ugd/247f25_1b90a1dbb51a490b934e46bcb2ff6e8f.pdf?index=true
    • https://53ebb62d-ddaf-432f-8dc3-1f4746653467.filesusr.com/ugd/bbd3cf_dd4f95f5f62c4ce9b9502952ab9024fc.pdf?index=true
    • http://wumokobaleto.epizy.com/10264340823.pdf
    • http://xutenujute.myartsonline.com/61273404070.pdf
    • http://nitigij.rf.gd/jepafikudekobutatofasi.pdf
    • http://vokozebutiri.rf.gd/trophy_guide_assassin_s_creed_odyssey_dlc.pdf
    • https://883cd1dc-02d0-4059-8fa2-99201f92b631.filesusr.com/ugd/6166c9_16a10d96c2d24d9cbf54ef7ef2133cdc.pdf?index=true
    • http://poluxik.epizy.com/duwuranukawawuwenuba.pdf
    • https://b9e1b105-38e0-4bbf-baad-90de1e2021e1.filesusr.com/ugd/432b07_47f410d52d6e41ed9f4383c14fcbb8ce.pdf?index=true
    • http://nelibusanexiput.epizy.com/zesofesagowug.pdf
    • https://587b455d-cc79-4428-8e80-a8b75ce23bca.filesusr.com/ugd/021ec8_abac0a02b07441eb962fab028c842857.pdf?index=true
    • http://jujageritoxo.atwebpages.com/book_report_outline.pdf
    • https://d046670e-94b8-4ea2-8efc-69fca9b502c9.filesusr.com/ugd/c0b427_c6548f8a75124d469fe49dca63922a09.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011b03.bin
8b6f4a57107ba9e260e2de5b967079eb6cddcde605f0087ab8b7a14eb333ceda		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11B03 5324 bytes
font_01_sfnt_off00012d15.bin
f8827e420fa40f24778623b5059f6f72778cfc06c4c04cf4045d5ad019fe4cb7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12D15 11448 bytes
font_02_sfnt_off0001545f.bin
6924b5463a63573bdb4cad3631530e09ac2834dfe8acd865c0dc956ab78b486a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1545F 16980 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.