Malicious PDF — malware analysis report

Static analysis result for SHA-256 64bad65a8fad23e9…

MALICIOUS

PDF

76.9 KB Created: 2021-04-17 07:20:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 87bc7a8a8ad701f3a90174903fa085ac SHA-1: d8ad3fd2e59b6c11371929c304be74c06d8c6d91 SHA-256: 64bad65a8fad23e90387134dceece62335610aef71c24abf4ecdff8940aeefa3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded external URI pointing to 'https://leonvi.ru/strik?utm_term=craftsman+12+inch+band+saw+sander+fence', suggesting a phishing or scam attempt to redirect users to a potentially harmful website. The document body, though heavily obfuscated, contains references to product names and application details, likely serving as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/strik?utm_term=craftsman+12+inch+band+saw+sander+fence PDF link annotation
    • https://cdn.sqhk.co/jodanonot/ehhRvjb/50379628773.pdfIn PDF document text
    • https://cdn.sqhk.co/sawijoturok/Tghif6D/4185329188.pdfIn PDF document text
    • http://teaitalis.space/pofirudesugijelutilonrq9q.pdfIn PDF document text
    • https://cdn.sqhk.co/bupitagalir/MJxhaha/splendor_online_booking.pdfIn PDF document text
    • https://cdn.sqhk.co/batitiviz/fgjig0z/borefojoxujamotilexajim.pdfIn PDF document text
    • https://cdn.sqhk.co/tukawezezo/gVk2mvz/zugore.pdfIn PDF document text
    • http://mushygushysayings.com/influencer_marketing_hub_tiktok_horariob9y61.pdfIn PDF document text
    • https://cdn.sqhk.co/jutusaxibu/1ERRhil/bugogipizezal.pdfIn PDF document text
    • https://cdn.sqhk.co/nalawanuxa/G0gijh6/don_t_ask_the_monkey.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/b128c8d2-bddc-4a83-887f-f26d82e8275c/skullcandy_soundmine_bluetooth_speaker_how_to_connect.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a5cc1cb4-2f99-4895-9f66-e3cb230fc980/how_does_dr_browns_bottle_warmer_work.pdfIn PDF document text
    • https://caa91486-5fcc-43b7-8b2b-5b817ae85bbe.filesusr.com/ugd/26bbcf_353ecf2f1a68466ca9b2a90f6b0a72d0.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/a70854b2-f653-49b1-9b26-a3be8742839d/how_do_you_reset_a_bosch_silence_plus_46_dishwasher.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e6ebc468-1ae6-42eb-aa91-ba2b8dfc19d9/how_do_i_find_probability_in_excel.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3887c2fa-e522-4894-b508-5e6445a82b6c/kulumakujim.pdfIn PDF document text
    • https://254b3b0b-79dc-4992-827c-fd4bb3db3178.filesusr.com/ugd/f515ca_38619e08d93a4d1482600a62f789cc44.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/83ee0cb8-2969-489a-9918-eaa904c86a5b/hobart_mixer_parts_near_me.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eefc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEEFC 5548 bytes
SHA-256: 546cf156e98a49b5083f22778133625868c5d683483e74fd5d0317c45d9124d8
font_01_sfnt_off000101c2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x101C2 10888 bytes
SHA-256: 794220616c073c5e389efc0c4c6231dbcf10988a71a359377d6db9eef95209b1

Open this report in the interactive analyzer, or submit your own file for analysis.