Malicious PDF — malware analysis report

Static analysis result for SHA-256 5dc290df913ae07d…

MALICIOUS

PDF

192.7 KB Created: 2021-05-08 22:26:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 996e77d0523d11b89084fa8d4b9a21c0 SHA-1: 58aae06e733733b6d8ed855ad1d024916f31f2ab SHA-256: 5dc290df913ae07deb41938e80dafae0daf5066c7877b0673e38b894a7c6aaaf
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9960

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/strik?utm_term=effective+modern+c%252B%252B+%25E4%25B8%25AD%25E6%2596%2587%25E7%2589%2588+pdf+github PDF link annotation
    • https://cdn.sqhk.co/wuwosexed/5gdcdij/egyptian_war_the_card_game.pdfIn PDF document text
    • http://sdfsdfsdf.shaketorch.com/67405966922.pdfIn PDF document text
    • http://vizazovabula.mywebcommunity.org/tippmann_98_custom_act_platinum_series_sniper_package.pdfIn PDF document text
    • https://cdn.sqhk.co/lalamiteliw/deeidge/81600911654.pdfIn PDF document text
    • http://tapabafana.22web.org/wisonejasoweluravix.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://xejolufu.epizy.com/49761287686.pdfIn PDF document text
    • https://s3.amazonaws.com/zunaduxa/78218518034.pdfIn PDF document text
    • https://c0771fee-1ba5-4dbf-bba5-a775c3d44c03.filesusr.com/ugd/544e7e_84eaa5f535574821ac70ab00f4a23b34.pdf?index=trueIn PDF document text
    • http://koxigumom.onlinewebshop.net/vocabulary_words_activities.pdfIn PDF document text
    • https://s3.amazonaws.com/folexapurilowe/53599950731.pdfIn PDF document text
    • https://s3.amazonaws.com/kavalukato/roomba_discovery_4210_battery.pdfIn PDF document text
    • https://5b0e1d79-1acc-45ba-a965-31015372eee8.filesusr.com/ugd/67f5f7_c60f14e395304e66bcde7a2179e3d1c4.pdf?index=trueIn PDF document text
    • http://safatagikev.rf.gd/54892713627.pdfIn PDF document text
    • https://s3.amazonaws.com/legenapi/39223544230.pdfIn PDF document text
    • http://tosipasakuvil.myartsonline.com/banking_sector_definition.pdfIn PDF document text
    • https://7be8961d-effb-4c78-a255-78c3c9f0be09.filesusr.com/ugd/3dd68e_8ffddfb879f54608af858d87a904cc37.pdf?index=trueIn PDF document text
    • http://loziruwofuni.rf.gd/48105405572.pdfIn PDF document text
    • http://xowuzaxu.onlinewebshop.net/acids_bases_and_salts_class_10_sample_papers.pdfIn PDF document text
    • http://savunibuguk.rf.gd/tawuxetom.pdfIn PDF document text
    • https://65d0a56f-4074-4e8f-9acc-29e6f8e8f663.filesusr.com/ugd/37655d_43a617bf747644d7b34347f656811c0b.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000fb04.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xFB04 134540 bytes
SHA-256: d44cfbb01167b5bb9e0ac5254e6280e8aed5a78b145f76a303605e38c57204e1
font_01_sfnt_off0002884a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2884A 3392 bytes
SHA-256: 5f9450682422a7d8e6d28e1318ca131f3f0db70a91bff925dd2220373c48b1eb
font_02_sfnt_off0002944f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2944F 5188 bytes
SHA-256: f5f27b1c49f09ecfea08c2af936f61a98b6fa50491fa2d0a6b92ca89ca3a6d03
font_03_sfnt_off0002a5cb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2A5CB 11816 bytes
SHA-256: fe9720f0efdd5d3ef5fd6e38398a5c57def4993927ec2c8e6f59cb61be258b74
font_04_sfnt_off0002ce54.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2CE54 16100 bytes
SHA-256: fdddb335ff8dece42f228d947c1e82464c0b4537f5387ada480d9c348f5f5637
font_05_sfnt_off0002e310.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2E310 4324 bytes
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3

Open this report in the interactive analyzer, or submit your own file for analysis.