Malicious PDF — malware analysis report

Static analysis result for SHA-256 5db9dc61c1fb7d6a…

MALICIOUS

PDF

80.9 KB Created: 2021-03-29 08:29:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9c28cb3551b347700ee13f5a56809226 SHA-1: 2836f5b9fe0947007c505b43e049522a0bfb23a7 SHA-256: 5db9dc61c1fb7d6abc80c3af603db5efe1c7af17a5b769e466f67e0ecd918c0b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL points to a domain that appears to be used for distributing malicious content, likely as part of a phishing or scam campaign. Although no scripts were explicitly extracted, the PDF structure and embedded URLs suggest an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/wix?keyword=chalet+on+the+hudson+cold+spring+ny
    • http://kijumubafenu.mypressonline.com/characteristics_of_a_good_computer_lab.pdf
    • https://cdn.sqhk.co/janurisu/ihgQROV/ravidatetimesu.pdf
    • https://lerekisisag.weebly.com/uploads/1/3/1/4/131408666/f35cbe092fb5b67.pdf
    • https://cdn.sqhk.co/penavagalo/DjhggA1/xavigefodikovigolisosipa.pdf
    • https://xuwojuzo.weebly.com/uploads/1/3/4/4/134471705/1027902.pdf
    • https://cdn-cms.f-static.net/uploads/4393489/normal_6032c254883fd.pdf
    • http://zujuzerawijuk.medianewsonline.com/decision_tree_regression_in_r.pdf
    • http://worabipupe.mypressonline.com/advanced_language_practice_download_free.pdf
    • https://cdn.sqhk.co/satukevaguka/ijcgfoE/texas_longhorns_college.pdf
    • https://cdn.sqhk.co/zasokolof/phijiib/99470282250.pdf
    • http://rumepado.mypressonline.com/jepolovijul.pdf
    • https://static.s123-cdn-static.com/uploads/4490746/normal_5ff4f2f9017f0.pdf
    • https://static.s123-cdn-static.com/uploads/4449793/normal_5fcd6a92e600b.pdf
    • https://cdn-cms.f-static.net/uploads/4475375/normal_604f74c175023.pdf
    • https://static.s123-cdn-static.com/uploads/4417813/normal_5ffb2fc1aee67.pdf
    • https://zefakibafiv.weebly.com/uploads/1/3/1/3/131383453/xapumosa-zudebakej-turibexetotor-pukuwamakod.pdf
    • https://cdn.sqhk.co/pazakazagoz/75V1p1x/wekaxetiroxizijej.pdf
    • http://fusavexupisedi.iblogger.org/backtrack_5_r3.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://bipaxoxibiva.rf.gd/canonical_form_of_state_model.pdf
    • https://6a1e2a5f-c456-4288-b9d5-5378f87870fb.filesusr.com/ugd/076fac_f9ff1d23533b491dbc9135a98dac753f.pdf?index=true
    • http://nugafafekovad.epizy.com/shimano_cycling_shoes_size_guide.pdf
    • http://lopakesuzuw.atwebpages.com/cambridge_ielts_9_listening_test_2.pdf
    • https://a4346b84-4611-49ab-b113-80c9188ca613.filesusr.com/ugd/078c79_426f69e5a68547e792dcc2c254da1209.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eeba.bin
62465671ad5c9e5cbbdd4a423a3838ba498d588c7f20e9682238b2a3a3be4e03		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEEBA 5340 bytes
font_01_sfnt_off000100e0.bin
dc024c49b205cea76550a659983eb75c46d0b81b5326528b393ad8c738b87080		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100E0 11684 bytes
font_02_sfnt_off00012838.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12838 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.