Malicious PDF — malware analysis report

Static analysis result for SHA-256 5be5e36ab909522e…

MALICIOUS

PDF

169.3 KB Created: 2021-04-03 11:11:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0d0a6c05f4b18d8300344bbf66033737 SHA-1: bcc540181fc2052a8511c59150d30f5633b92119 SHA-256: 5be5e36ab909522e29c8aee946306ea93431ca3e84afe7d866365bce286552a3
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and contains an embedded URL pointing to a suspicious domain. The document body, though heavily obfuscated, suggests a lure related to 'Tibetan Buddhist mantras PDF'. The presence of an external URI heuristic further supports the malicious intent of directing users to a potentially harmful external resource.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3490

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=tibetan+buddhist+mantras+pdf
    • http://grenkasalo4.xyz/897934000647roqp.pdf
    • https://static.s123-cdn-static.com/uploads/4393208/normal_5fcbac92227ee.pdf
    • https://cdn-cms.f-static.net/uploads/4421468/normal_603ddf1bee639.pdf
    • https://cdn.sqhk.co/xevowuto/blhdghF/toca_builders_apk.pdf
    • https://cdn-cms.f-static.net/uploads/4381289/normal_5fe82f4455fa8.pdf
    • https://nujalujuxak.weebly.com/uploads/1/3/5/3/135347358/5e16fefc19fab77.pdf
    • https://cdn.sqhk.co/wokinuge/jjieMmp/free_student_attendance_tracker_app.pdf
    • http://all-casino.xyz/prevent_form_submit_on_button_click6gwv6.pdf
    • https://mufusudakewita.weebly.com/uploads/1/3/2/6/132681672/wasusobasitix-jozodebumewadi-rinegirub-guwitagib.pdf
    • https://cdn.sqhk.co/fadejiweruw/ahijhLk/final_heroes_mod_apk.pdf
    • https://cdn-cms.f-static.net/uploads/4474985/normal_60400bd40a4f2.pdf
    • https://jagunafine.weebly.com/uploads/1/3/4/3/134363358/zoladuj_lizixazipilazi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • http://www.thdl.org/http://www.thdl.org/Tibetan
    • http://smc.org.in)MeeraRegularMeera2016SMC7.0.0+20171102Hussain
    • http://smc.org.inhttp://smc.org.in
    • http://www.opentle.org
    • http://www.daltonmaag.com/
    • https://0c2a7d7b-be9d-4ef2-a94c-09ca905cc17d.filesusr.com/ugd/7d21c0_58bb8f87602b45b680b86d73a5adb4d8.pdf?index=true
    • https://6593eeda-10fe-4128-810f-cbbc79f0a4f8.filesusr.com/ugd/c0a4bf_e5ce04ee5036431faf9023c2a8d2355c.pdf?index=true
    • https://e148473a-3d1a-46f8-b788-fbc1f5af68d4.filesusr.com/ugd/e1e70b_9c9f068438ad4002bac5520c8c30c9e7.pdf?index=true
    • http://zefinut.rf.gd/19475608020.pdf
    • http://wikatamuk.rf.gd/scrivener_3_android.pdf
    • http://povemuxituziv.epizy.com/wukeraxuzip.pdf
    • http://dapizifotokom.epizy.com/4548492814.pdf
    • https://ef9935f7-a918-44a1-999f-f1d50a45e4a7.filesusr.com/ugd/b463f2_dc77419b1b84440c8d86178d0265c771.pdf?index=true
    • https://748f1d53-d141-46c1-926a-d14fc69713a3.filesusr.com/ugd/e3ed1f_e73072097b08425cb7cc7090033ada45.pdf?index=true
    • http://scripts.sil.org/OFL
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.htmlTibetan
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNU
    • http://www.gnu.org/copyleft/gpl.htmRegular
    • https://gitlab.com/smc/meera/blob/master/COPYING
    • http://www.gnu.org/licenses/lgpl.htmlRegularDanhHong
    • http://www.geocities.com/dnhhng
    • http://sinhala.sourceforge.net/
    • http://sinhala.cvs.sourceforge.net/viewvc/*checkout*/sinhala/sinhala/fonts/CREDITS
    • http://www.gnu.org/licenses/gpl-2.0.html
    • http://www.gnu.org/licenses/gpl.html
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org

Extracted artifacts 17

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00014427.bin
8400bfcb5a916dee3e8b92dd83527e1a658d7eca470406a997b7ea120c255146		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14427 9088 bytes
font_01_sfnt_off000162b8.bin
b66de0ed902e18245a724560d53716e8e0bedda6015cf6b5309b4bb161ad9462		 pdf-font-stream PDF embedded font (sfnt) at offset 0x162B8 5108 bytes
font_02_sfnt_off000173cd.bin
9123a1c4da111a845aa5fa8204a969b8e324c5c5105770c66282dcacc97015c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x173CD 4472 bytes
font_03_sfnt_off000183ef.bin
354bffdca099b9686530f58636e1cf9d59606dd6b3ef7ff37044309d07ef9534		 pdf-font-stream PDF embedded font (sfnt) at offset 0x183EF 13016 bytes
font_04_sfnt_off0001a07d.bin
8574c34eb3aac82550fe44487a2c00a4f41ac06b3a76033a2c9499548a99d4d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A07D 5452 bytes
font_05_sfnt_off0001b24f.bin
8f9a181dd53415c68c870966de149f6174130025868b637ad5ac7e351b9c4ccc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1B24F 3728 bytes
font_06_sfnt_off0001c083.bin
ac4d518cbe31e952314f71c080281c6c4db035f3851c217f2244b139e6996404		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1C083 5544 bytes
font_07_sfnt_off0001d139.bin
c63cd7786f10e3d394a3baaae1bb432089b0fab257e3848d78baffec0584c8e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1D139 3712 bytes
font_08_sfnt_off0001df00.bin
5d0b1563e075024662aa2d5fe452bea0be3f603821a1bfb2ed411a6c074acc51		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1DF00 6808 bytes
font_09_sfnt_off0001f58c.bin
6dbe7bc20cd1affd18b234985312a5abbc4f510b8170d2bd499adcffb2b773d7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1F58C 3700 bytes
font_10_sfnt_off00020415.bin
74ff98512c7529ea942aeeb45c80c1758575b19acf1f55005c305d71e61e4665		 pdf-font-stream PDF embedded font (sfnt) at offset 0x20415 7332 bytes
font_11_sfnt_off00021833.bin
fd5f494d483be08022d8e77b6ac7d8fc4bf0120c37da8335db62ed1d331f0e06		 pdf-font-stream PDF embedded font (sfnt) at offset 0x21833 18780 bytes
font_12_sfnt_off00024bc4.bin
d3469b23cee3bc6529b6c163e4d0bc73849f1e59d0792000d2e6346dc7a776ea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x24BC4 17680 bytes
font_13_sfnt_off00026652.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x26652 4324 bytes
font_14_sfnt_off0002745c.bin
599046bcd20fcee0d7eb1c9e0e12c276f342f067c7ccbac91e96dfa82e94833b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2745C 4120 bytes
font_15_sfnt_off00028431.bin
b31742849583ea332b1dedf05d922cacfbd50c41631943b47878277bdcc55898		 pdf-font-stream PDF embedded font (sfnt) at offset 0x28431 5280 bytes
font_16_sfnt_off000294e8.bin
b078de14eb4336e95ad9089092d3fa84474045b133e381d6c5f36ed8a1b240e7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x294E8 4340 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.