Malicious PDF — malware analysis report

Static analysis result for SHA-256 5e5d5b698bec620e…

MALICIOUS

PDF

78.1 KB Created: 2021-03-25 04:36:25 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6c02779a7114a425cdc0494078ee05aa SHA-1: 1f793500b6c464df3d6642f914ce29f39912a841 SHA-256: 5e5d5b698bec620e2d95207dd4131cdaa584806296ed6ce00f4a7db4481424c6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.Trojan'. The embedded URL points to a suspicious domain, and the document body, though heavily obfuscated, suggests a lure related to a movie trailer. The presence of embedded URLs and the overall detection profile indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=white+fang+2018+movie+trailer
    • http://train-home.ru/68748478867cby6u.pdf
    • http://flathead.us/5230886417739qbg.pdf
    • http://storefromit.pro/word_finder_scrabble_cheathv3mt.pdf
    • http://antonioit.fun/dibufezapilinexewefajenwua4g.pdf
    • http://bristol-yalta.run/the_gene_ontology_handbookl7cht.pdf
    • http://savadaqwe.space/gipolibukozuwanogekpzovu.pdf
    • http://tryraisins.club/vujuwozitujifunasoda5a1ms.pdf
    • http://lynciguest.com/freely_freely_you_have_received_sheet_musicztsds.pdf
    • http://firstreadersclub.com/6145751499jh2oe.pdf
    • http://markettop.pro/how_do_you_strengthen_your_intuitionf03oj.pdf
    • http://mainsale.info/sniper_jungle_commando_counter_attacks2grnp.pdf
    • http://centerverifybadge.com/trx_force_12_week_program_resultstlvvn.pdf
    • http://goodnatural.space/dragons_titan_uprising_hack_deutschc6ttp.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://8a088b33-2c08-4a8c-8d17-3b052cb5145e.filesusr.com/ugd/94e5ef_0f6a7492fd97426f8340d834f1c87b02.pdf?index=true
    • https://d128792e-e0a8-46e0-98ed-b941f5da69b2.filesusr.com/ugd/b98abb_2b66fe4c92144dbfbffca06b82768027.pdf?index=true
    • https://9c7fa877-6682-4281-967b-1772d9bf2649.filesusr.com/ugd/b1277d_8b6d76c2a3594b1097492be37d44e6e4.pdf?index=true
    • https://e53c8fcc-339b-4d8f-83f6-44ddc8c6ace4.filesusr.com/ugd/1ea9c4_cf8c8d54789a4501a95ade716502f076.pdf?index=true
    • https://47c0d0ed-94e3-447f-940a-e265262d053f.filesusr.com/ugd/a43ec6_4511f30544704be28a7c078b03b19fac.pdf?index=true
    • https://fb7bf4c5-056f-4058-a7d1-073478569b53.filesusr.com/ugd/d90490_77e20f30b8ab4cbd9721fb715417576c.pdf?index=true
    • https://dce579ed-4708-43c3-aaeb-2c76a6268d78.filesusr.com/ugd/944939_a087c4e2661943f4b52faf85e9753f2e.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000efd7.bin
3969b07de35b93e76935ed0a40a273a876d83db2e4ddc42934c09d45f0a85a80		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEFD7 5596 bytes
font_01_sfnt_off000102ce.bin
c86051fdf29f71773578d907586ba2e454ff725456e7d8446467d989f8d36641		 pdf-font-stream PDF embedded font (sfnt) at offset 0x102CE 11504 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.