Malicious PDF — malware analysis report

Static analysis result for SHA-256 630ef1b706d4aefb…

MALICIOUS

PDF

83.2 KB Created: 2021-05-14 20:44:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cd5e72f7d132e9cd675f0500022d40dc SHA-1: 2e72f77b3da98bd8a5c1903b691a47864c4587bf SHA-256: 630ef1b706d4aefbcad3e7c60faabc5b59a689e6a1966d64f07eb24099e8238e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a website related to Google reviews, which is a common lure for phishing attacks. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware distribution. No scripts were extracted, but the presence of external URIs suggests an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=how+to+get+5+star+google+reviews
    • http://kozidozilujivox.getenjoyment.net/beyond_brawn_workout_program.pdf
    • http://leludezoz.scienceontheweb.net/luta_antimanicomial_e_feminismos.pdf
    • https://cdn.sqhk.co/mitukutowum/GgdZiiO/special_operations_forces_medical_handbook.pdf
    • http://wulixiv.sportsontheweb.net/past_tense_present_perfect_tense.pdf
    • https://cdn-cms.f-static.net/uploads/4366348/normal_603638360065f.pdf
    • https://cdn-cms.f-static.net/uploads/4413563/normal_601a0209547be.pdf
    • https://static.s123-cdn-static.com/uploads/4458635/normal_600575da76a6f.pdf
    • https://cdn.sqhk.co/wazafanez/CgbRhb2/53987171102.pdf
    • http://pidagenavuziw.mywebcommunity.org/dewofezozejolusasoza.pdf
    • https://cdn-cms.f-static.net/uploads/4379483/normal_6045eb95cee09.pdf
    • https://cdn.sqhk.co/lozuzupadis/Wkvjfif/pinball_fantasy_psp_download.pdf
    • https://cdn.sqhk.co/lopijikuvi/ekzhfii/77768935454.pdf
    • https://static.s123-cdn-static.com/uploads/4393189/normal_5fec1dfa2317b.pdf
    • https://static.s123-cdn-static.com/uploads/4365599/normal_5fe1625919324.pdf
    • https://static.s123-cdn-static.com/uploads/4406782/normal_600603915af40.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://80b2a579-f9ed-4aa0-b91a-ac3c8973c086.filesusr.com/ugd/353d00_d1448a55d3814cd291223aef5f69cae7.pdf?index=true
    • https://8d275f60-8e36-4e70-8574-b6d542a617c4.filesusr.com/ugd/dbf6c2_6bb43e58e5b34e0abde52c205c5eb264.pdf?index=true
    • http://rogofideb.onlinewebshop.net/how_to_do_apqp.pdf
    • http://sulijugofogim.onlinewebshop.net/sisixapeposirediv.pdf
    • https://da99f664-88c7-4a27-98aa-0bbcec2e8f57.filesusr.com/ugd/66f3f9_d2751a381de844ec8e26eab53e8fb37e.pdf?index=true
    • http://bivojeda.atwebpages.com/4_syllable_words_list.pdf
    • https://7be326e9-a1fd-4761-a84c-83c904220737.filesusr.com/ugd/37e945_eb2e60bdfa324b909edd691cbad5935e.pdf?index=true
    • https://82656f1f-dd0f-4426-89ca-c5688288f975.filesusr.com/ugd/56de54_ea3c48a2012143768c8ef89b747c0cad.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f9a8.bin
8df3e7d0d24df7f957a798608d62ec68082f84af99286bac27d3404ff1bd06e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9A8 4772 bytes
font_01_sfnt_off00010a10.bin
b4d52f7dbbf8c113461cfa2cdd1da2f2312dbd4fd04e6b6ece44c82585c309f1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A10 10916 bytes
font_02_sfnt_off00012f5c.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12F5C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.