Malicious PDF — malware analysis report

Static analysis result for SHA-256 6637dee8fe5ad156…

MALICIOUS

PDF

78.6 KB Created: 2021-03-30 03:26:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 124e2546e6148efd7f2e6e461fceb66f SHA-1: dd46a155f61a986308dd29e0b866fa26494b9f50 SHA-256: 6637dee8fe5ad15642df0209afd832f56f8862c97f01f6b338c937e1c7b44140
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The document body, despite being heavily obfuscated, contains references to 'crested geckos' and 'fruits', which is likely a lure to disguise the embedded malicious URL. The presence of multiple external URLs, including one flagged as potentially malicious, further supports this. No scripts were extracted from this sample, but the PDF structure itself likely facilitates the redirection to the malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=crested+geckos+eat+fruits
    • https://cdn.sqhk.co/zogobadakedu/hbqjbif/64829453335.pdf
    • https://cdn.sqhk.co/govovazeket/4Xgcwl0/girl_skins_namemc.pdf
    • https://cdn-cms.f-static.net/uploads/4473651/normal_601925f263c26.pdf
    • https://cdn.sqhk.co/woxekivepi/cypWifq/wopibopazezurozev.pdf
    • https://static.s123-cdn-static.com/uploads/4387589/normal_6006bbc745e00.pdf
    • https://cdn-cms.f-static.net/uploads/4377403/normal_601be160ebf64.pdf
    • http://forexgeeks.net/hang_glider_airplanebmhhl.pdf
    • https://cdn.sqhk.co/tilafukefuwe/hbibA5K/gubuxurudegobi.pdf
    • http://lavka-karamel.ru/craftsman_yt3000_42_partsly55j.pdf
    • https://cdn.sqhk.co/wepenujofow/gghfsxp/chatous_apk_mirror.pdf
    • http://uuuuull.space/malufawotutabipupubewopiwl90o0.pdf
    • http://nimolebefiv.22web.org/61226042667.pdf
    • http://megalit-korolev.ru/fufegafezomexx7mtn.pdf
    • http://walkover.me/word_formation_exercisespgi0g.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://712e085e-8422-4094-ae2e-709d430f1fc9.filesusr.com/ugd/bf8edb_2c11a1ff7cf24ecbbfba213978afc6e7.pdf?index=true
    • https://4ef57e19-9a2e-4e6f-a444-f6b59f982a39.filesusr.com/ugd/4c1554_8fb9a649a054461d908ff24736912946.pdf?index=true
    • http://tixuveji.epizy.com/a_ha_mtv_unplugged_summer_solstice.pdf
    • http://wosumobikufiw.rf.gd/bully_obb_mod.pdf
    • https://s3.amazonaws.com/jefobexapulow/triangle_rectangle_et_cercle_circonscrit_4me.pdf
    • https://s3.amazonaws.com/falufusu/bowditch_volume_1.pdf
    • https://c4a0f302-b060-43a0-af10-a0364da5eca7.filesusr.com/ugd/c6d327_5803aa9300ec4b81a881eb7eeed1c1a5.pdf?index=true
    • https://adc0bc6f-2b4d-4951-bce0-9128d215fa34.filesusr.com/ugd/5ea4d5_d1a2799007e54a7da54d9c25d0c79faf.pdf?index=true
    • http://zukuwegafedes.epizy.com/nukit.pdf
    • https://0aa989e7-076c-475f-bc22-fff5ae310860.filesusr.com/ugd/b44be6_887fe1482c6e46aba272193b9ef123e9.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f74c.bin
033f919c954e01e8c133f3885e7a89ff5d8390e0b3182b0407f9f99fc05b7886		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF74C 5124 bytes
font_01_sfnt_off000108cf.bin
7bc034c91f09427bfaf6be142ed5b0820a6adea9c173b785a348d58b6635fe86		 pdf-font-stream PDF embedded font (sfnt) at offset 0x108CF 10820 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.