Malicious PDF — malware analysis report

Static analysis result for SHA-256 62291204cda6fb97…

MALICIOUS

PDF

70.4 KB Created: 2021-04-02 03:34:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9a4a322f68e9fb5bc1a08a74d4b05b12 SHA-1: 2a1bfa20203bd4085b798b8a0a699271a3abcae6 SHA-256: 62291204cda6fb97b2250de7ce5ecf110e613e336dbcac9b83f1f46cddcbafc0
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL, identified as a phishing attempt. The ML classifier and ClamAV detection strongly indicate maliciousness. The document body, though heavily obfuscated, appears to be a lure related to song lyrics, directing the user to the malicious URL for further action, likely to download a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=look+who%2527s+back+song+lyrics
    • http://tijukilebag.getenjoyment.net/bomufuxufisito.pdf
    • http://bexemusu.mypressonline.com/inhalation_route_of_drug_administration.pdf
    • http://nenugatigubom.66ghz.com/definicion_de_enfermeria_segun_varios_autores.pdf
    • http://xezixaz.getenjoyment.net/ap_telugu_news_papers.pdf
    • http://tumijosejagag.22web.org/interesting_facts_about_samuel_beckett_bridge.pdf
    • http://xufonewujisos.scienceontheweb.net/tnpsc_current_affairs_january_2020_in_english.pdf
    • http://sajulakukomokas.22web.org/bodybuilding_workout_timetable.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/redegelesibif/vutexidofejoxuk.pdf
    • http://tifojuluguzix.epizy.com/7203000889.pdf
    • http://fojosotum.myartsonline.com/amsco_apush_chapter_23.pdf
    • https://s3.amazonaws.com/gifojuxaxeva/pated.pdf
    • http://bojefej.epizy.com/reaction_of_zinc_and_iodine_lab_report.pdf
    • https://85ed388a-52e0-4e79-9737-9d4b769dda71.filesusr.com/ugd/bb10c5_c71f782abfc44d12a3bc53e1c93a1d41.pdf?index=true
    • http://jitawidavez.atwebpages.com/amazon_s_antitrust_paradox.pdf
    • http://mepejolowu.rf.gd/27431627062.pdf
    • http://vuriruzuminomu.epizy.com/lulevaruwijevuk.pdf
    • https://s3.amazonaws.com/fodose/51266035028.pdf
    • https://0c2a99dd-71fd-4a0d-b96f-672cfa785c21.filesusr.com/ugd/515c54_45329c057946411283f8da32c74b7f0b.pdf?index=true
    • http://datidogebe.epizy.com/bijefikubotenomu.pdf
    • https://s3.amazonaws.com/tokatefozude/fokirisavup.pdf
    • https://f4dd034e-00c7-465c-b850-fb2d75accad5.filesusr.com/ugd/769f78_4f6c4ce4ce5d4223be2de1f45cea3203.pdf?index=true
    • http://pakidenekarudi.epizy.com/basuwowa.pdf
    • http://sajulugebimisu.myartsonline.com/miscellaneous_compounds_inorganic_chemistry.pdf
    • https://s3.amazonaws.com/gifojuxaxeva/brother_hl-2140_laser_printer.pdf
    • http://zuzenif.rf.gd/surface_pro_3_pen_annotate.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d711.bin
c7c98638b3302db3874a95210e00dab4b928f162ad1cdeb3ae835ddfa4501720		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD711 5436 bytes
font_01_sfnt_off0000e9ae.bin
2b1495656041d87884f52ffc58d71150d67795171a518057a8a02c8490bc9bc5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE9AE 10408 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.