Malicious PDF — malware analysis report

Static analysis result for SHA-256 5e824600f5f90d6c…

MALICIOUS

PDF

82.8 KB Created: 2021-03-22 18:58:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-28
MD5: 1a62902241763b6051aad5bbd9d17b7a SHA-1: 584dfa67ec388312abdd419385abf9f36b00a73d SHA-256: 5e824600f5f90d6cf846bff2604dbfb3b2647157d7c66646b2b8362b0a8193b3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool sometimes used to create malicious documents.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/award?keyword=carnitina+hcl+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4389820/normal_601594e2b644a.pdfIn PDF document text
    • https://cdn.sqhk.co/pavoraxebute/cLghihZ/60671065177.pdfIn PDF document text
    • https://cdn.sqhk.co/jewimebobi/cBhejC5/photo_editor_app_for_pc_windows_8._1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4416149/normal_5ff0a78a49ad1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4373527/normal_5ff7809884bf2.pdfIn PDF document text
    • https://cdn.sqhk.co/foxoxaze/hcii5Cz/clear_widget_for_todoist_and_to_do_planner.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4481527/normal_5ff158b72b13b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4427820/normal_604071cd5fbe1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4443341/normal_6018af3807d81.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4415936/normal_5feb4fb2b80c4.pdfIn PDF document text
    • https://cdn.sqhk.co/mowanideju/wigyjhO/strike_fortress_box_apk_oyun_indir_club.pdfIn PDF document text
    • https://cdn.sqhk.co/fomeluxilim/CrhgQyF/38382663305.pdfIn PDF document text
    • https://cdn.sqhk.co/gixedomawa/ihghgeK/best_free_meme_generator_for_ios.pdfIn PDF document text
    • https://cdn.sqhk.co/letareximo/anhbha2/gobonuvijowoxexopifagopig.pdfIn PDF document text
    • https://cdn.sqhk.co/kixagixupo/LAAghf6/88178180955.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/fe33f1c4-f66e-4b14-9000-9d8f4ddf5020/jadawazegugovofesedob.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6bbbfb27-8772-45db-9bb4-cecad4790c2d/melozafalubomite.pdfIn PDF document text
    • https://s3.amazonaws.com/rikolesafuwofar/6953531513.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/faae1331-7a30-409b-adda-a4c592220d74/25239504474.pdfIn PDF document text
    • https://s3.amazonaws.com/tidigudetefumof/gmat_official_guide_2017.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fcdb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFCDB 4648 bytes
SHA-256: 66f80770c33b85749c2bf4385650aea9e099bff0ac616be01488acc073f23d45
font_01_sfnt_off00010c96.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10C96 10396 bytes
SHA-256: 136759b09cd3f8c84291859ac3a05dc4490acf422cef0e4ecdbbd003c0c176b7
font_02_sfnt_off00013047.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13047 4324 bytes
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3

Open this report in the interactive analyzer, or submit your own file for analysis.