Malicious PDF — malware analysis report

Static analysis result for SHA-256 5f2373f713796b9d…

MALICIOUS

PDF

76.0 KB Created: 2021-03-30 12:39:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 53a99bb9e386e5f987d979af4253f4cf SHA-1: 9d14da63a12daa1fd68c986f915c45f048271068 SHA-256: 5f2373f713796b9d49b5187460b23ce587989f008cc835220f766392d0deed57
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, contains metadata that could be used to disguise its malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wix?keyword=primary+colours+light+and+pigment
    • http://shlifovka-pol.website/how_to_find_the_surface_area_of_a_regular_polygonaq6mk.pdf
    • https://cdn.sqhk.co/lawafopugu/digYhaT/spirit_run_cuts.pdf
    • https://cdn.sqhk.co/nozedimasav/igjhcTF/age_of_pope_in_history_of_english_literature.pdf
    • http://lnstagram-helping.live/implementing_the_lexical_approach_lewisctul8.pdf
    • http://feelslike35.com/carry_on_my_wayward_son_guitarbsfel.pdf
    • http://grampus-shop.com/4383263529208uh2.pdf
    • http://instacopyrightcenter.com/sunbeam_oster_bread_maker_pan_5891tcwzs.pdf
    • http://romeoplanet.club/bajefuwofebulexagili74a.pdf
    • http://datab.vip/zowefumijizvv1o8.pdf
    • https://cdn.sqhk.co/jotapepikota/ficghhf/soda_dungeon_2_warrior_dimension_guide.pdf
    • http://lnstagramverifiedsbadgesforms.com/basedovamadutidekomokanajq73o0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/varolexexus/12355761831.pdf
    • https://s3.amazonaws.com/subopukomanaw/72691466958.pdf
    • https://920f4c01-5fd6-4c40-8b27-b99972fecb60.filesusr.com/ugd/d63aaf_8d1cea20b84649f7959011431704f9ec.pdf?index=true
    • https://19508648-7f28-415f-8121-b57715dc1465.filesusr.com/ugd/9734e7_67b2251f60ae480988824677323da621.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ab603c87-f369-4e0e-bbbf-133053ff0c13/the_grand_strategy_of_the_byzantine_empire.pdf
    • https://d19688e0-347f-4d9d-8cb3-d47c6e049f3d.filesusr.com/ugd/c618e9_c6115306c58f40549d42576247b03cc5.pdf?index=true
    • https://uploads.strikinglycdn.com/files/51c99324-63bc-4db7-bc66-614729bc6c72/79156842943.pdf
    • https://f110cc6a-49d6-427c-9ab6-a3a4d323b004.filesusr.com/ugd/9e53d4_5a14093ddfab4193a2ea787e4f0e1484.pdf?index=true
    • https://s3.amazonaws.com/novipaliwid/netupikisavaritidij.pdf
    • https://438e95ed-c264-4db5-88d3-1a9ca8b91b86.filesusr.com/ugd/733c1f_9448506ea1db4756ab776b02f0723e28.pdf?index=true
    • https://s3.amazonaws.com/pojikovewijeja/the_boy_in_the_striped_pyjamas_movie_watch_online_free.pdf
    • https://uploads.strikinglycdn.com/files/73f68db4-cb40-4503-bddb-7fae307ac15c/why_do_my_legs_hurt_so_bad_in_bed.pdf
    • https://s3.amazonaws.com/zoxewudunigus/why_does_my_furnace_run_but_not_heat.pdf
    • https://uploads.strikinglycdn.com/files/29181d76-6ce5-44b8-8549-8e414ce37300/dyson_cyclone_v10_animal_cordless_stick_vacuum_-_iron_purple_review.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dc08.bin
c7389aa7a9e7ee20d4d4fb6a800df60c88029ca8baa1f993a5bd2c47dc9f83bd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDC08 5472 bytes
font_01_sfnt_off0000ee75.bin
155f821f712ea72d125c8803d0dd1d59fc4e154bc2c8c9fab37044e788f6c2d6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE75 10680 bytes
font_02_sfnt_off000112ba.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x112BA 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.