Malicious PDF — malware analysis report

Static analysis result for SHA-256 5ff837c1b0db56a7…

MALICIOUS

PDF

152.0 KB Created: 2021-05-19 13:11:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 11e9f8374226a854e65961dd3baf7845 SHA-1: 7542e8306238d605b7b46b726ce7e340e851f94d SHA-256: 5ff837c1b0db56a70e7efeb1540f4e07d95f789cadd5324bab5dd901bb57d2f6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, indicating a phishing or trojan threat. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site. No scripts were extracted, but the presence of an embedded URL strongly suggests a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9976

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=%25D9%2585%25D8%25A7+%25D9%2585%25D8%25B9%25D9%2586%25D9%2589+%25D8%25A7%25D8%25B3%25D9%2585+%25D8%25AF%25D8%25B1%25D9%258A%25D8%25AF
    • https://topejaliwas.weebly.com/uploads/1/3/4/3/134305960/69c5e536.pdf
    • https://diwuxofemuji.weebly.com/uploads/1/3/1/4/131407179/dujapikuz-rovitagi-xojeba.pdf
    • https://nibapexi.weebly.com/uploads/1/3/0/9/130969889/xuwudeloruf.pdf
    • https://static.s123-cdn-static.com/uploads/4529893/normal_5ff3e7b1ae428.pdf
    • https://dowamodugepaxa.weebly.com/uploads/1/3/0/7/130739159/radaru_wokozikerevu.pdf
    • https://cdn-cms.f-static.net/uploads/4485705/normal_6059490a1e466.pdf
    • https://static.s123-cdn-static.com/uploads/4462775/normal_5ffd9e6080b7c.pdf
    • https://static.s123-cdn-static.com/uploads/4530910/normal_6000873684d82.pdf
    • https://cdn-cms.f-static.net/uploads/4451544/normal_6059021e6ce4c.pdf
    • https://figokafudifugi.weebly.com/uploads/1/3/1/3/131383964/a9d1e68af1.pdf
    • https://zajinepimasi.weebly.com/uploads/1/3/2/8/132815118/cbcd1c55e4e2.pdf
    • https://fifubinagate.weebly.com/uploads/1/3/4/8/134854053/3690165.pdf
    • https://static.s123-cdn-static.com/uploads/4452621/normal_5ff0d6a7581d2.pdf
    • https://dapalirodo.weebly.com/uploads/1/3/1/4/131483520/jujuzelufegulo.pdf
    • https://cdn-cms.f-static.net/uploads/4453734/normal_60450b885c58c.pdf
    • https://koniwosusuzese.weebly.com/uploads/1/3/1/8/131856176/6663461.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/8d6a7b8d-dd43-4469-bc91-e23dc0051515/zopunes.pdf
    • https://uploads.strikinglycdn.com/files/ef592dc7-7f11-4f6d-aa47-6dc7e0fb2456/about_roland_barthes.pdf
    • https://uploads.strikinglycdn.com/files/adaf73ca-39ba-4ee1-8f07-5a74618938c4/lewixubup.pdf
    • https://uploads.strikinglycdn.com/files/4658f70b-7762-4554-8b50-e7ad4e397373/dell_c1765nfw_printer_wifi_setup.pdf
    • https://uploads.strikinglycdn.com/files/c02e9c26-c9cf-4713-b36e-70d83ca41fcb/midnight_sister_souljah_book.pdf
    • https://uploads.strikinglycdn.com/files/b58a3978-d4db-481e-abb0-eb795da58838/anatomy_for_the_artist_sarah_simblet.pdf
    • https://uploads.strikinglycdn.com/files/bde0a1c9-73f1-48bf-99b3-fa09e866ba19/grammaire_franaise_niveau_universitaire.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off000214ca.bin
d2888fb074cf1f0c25e59cfaa3b95a4433a98f8d32f1824810220765268e2960		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x214CA 34156 bytes
font_00_sfnt_off0001cb3f.bin
60a2d6429503f7a4ddaf98851b2b9757a5da54dd45bab0a2aed837b7042708be		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1CB3F 4068 bytes
font_01_sfnt_off0001d91e.bin
129a166d47674e9f6d8dff48fc6cc8e749d29389ae49e297099b2806ff8f85dd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1D91E 9944 bytes
font_02_sfnt_off0001fb00.bin
a7866a64ac2e8ae8ec4a9760d6d38b8e0d8c4b133749cf6bdf45a3b6acef4a87		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1FB00 17356 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.