Malicious PDF — malware analysis report

Static analysis result for SHA-256 62b57e9603bd658b…

MALICIOUS

PDF

88.0 KB Created: 2021-06-07 20:00:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: 84198c6c81ab9cb9a3553f322fa60b3c SHA-1: 04999b41d7db0d22434c40ba1491e0e3abdeb613 SHA-256: 62b57e9603bd658b7fc07007deb5240b78a11eee8495874cd30a0ee63e81bac9
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan. The document body, though heavily obfuscated, contains references to 'Bts v winter bear mp4' and 'wkhtmltopdf', suggesting a lure for media content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/123?utm_term=bts+v+winter+bear+mp4 PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4443608/normal_5ff8d63262d3e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4404528/normal_5ff4b32f71228.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4469349/normal_60579e9db2efe.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/fe2767f9-3c91-49d9-bee6-59bfa8cfb37a/sevajivod.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/abde809c-5e53-4c21-b11f-dc83f4090663/6872901653.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6590d9c4-3700-4ab0-9849-a03f4cb77d04/who_made_up_the_3rd_estate_in_france_in_1789.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/055f10be-8316-4318-b97c-46df1da5dd79/hp_designjet_500_printheads_not_functional.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a5e42b69-b9d9-40e9-a462-a85044d6577f/1148781206.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/79110510-46f6-4cd4-8fc6-020cffbdb760/94467962042.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/56cb996a-314a-44d4-ae64-5e42b9110484/68791051426.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2af37580-f6f8-42d3-b268-59482d04d60c/xuvatalanakubefop.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a39683a4-25ad-45dc-a946-1eff9ea483e3/how_to_take_the_nursing_jurisprudence_exam.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4429f38a-e9a6-4276-b08e-772f5d90ba7f/seketuzesutexi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8e2e7969-f21f-4f4f-a4cf-2d0a365e2191/lord_of_the_flies_study_guide_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3561f953-3d0e-493b-a230-39c3537cc7b2/python_tutorial_w3schools.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0b03e2e2-b50b-4a17-9859-46a7ff609795/law_school_confidential.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e55587a0-2cb2-4466-b084-ed442c51fad1/33556070991.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bac4cf44-2093-4985-83fe-4d82b1730e37/2039211430.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dad68250-24f4-400a-9d61-327a9375b1ea/69595465371.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e63c588a-d533-4fb8-b3ff-00e03c26b803/79628313712.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dc73.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDC73 3516 bytes
SHA-256: 198caa07014e4db04ee93852610f83ce7d50861fa39b6d372677e3b12cdb6431
font_01_sfnt_off0000e906.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE906 5040 bytes
SHA-256: fdbfd732af8fb81cc0325da2495ff5c9157b65dbc253bf1d1e52ff2c0cb45e65
font_02_sfnt_off0000fa08.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA08 3176 bytes
SHA-256: 465ca73762602111eb42ec0885fb5548068e0c86f32f08b1d1521b924846ca12
font_03_sfnt_off000106da.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x106DA 11144 bytes
SHA-256: a866a401521fa603e596cc307cd427f04cd9242b68f204df6cc2daad62d4e386
font_04_sfnt_off00012cd5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12CD5 16792 bytes
SHA-256: 4e0aeeb34d13d05adcefa79e6b804a79b12b0b490a5691b22d5d6846d21d326e
font_05_sfnt_off0001439a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1439A 4324 bytes
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3