Malicious PDF — malware analysis report

Static analysis result for SHA-256 66fb3589d086ad64…

MALICIOUS

PDF

76.3 KB Created: 2021-03-27 16:03:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e3a87eecc7941cacd637203de7653a54 SHA-1: 6d6efa06764dbeca39fa3cd3070fadde6c87b285 SHA-256: 66fb3589d086ad649352a6b9576e877b8f09c595d83372fef4a7af0c1ca529e3
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged by ClamAV as a phishing trojan. It contains an embedded URI pointing to 'https://jottigo.ru/award?keyword=ganesh+atharvashirsha+pdf+gujarati', which is likely a phishing lure or a distribution point for further malicious content. The ML classifier also indicated a high probability of maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6922

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/award?keyword=ganesh+atharvashirsha+pdf+gujarati
    • http://rezotu.xyz/modern_poetry_books_like_milk_and_honeyg8t4q.pdf
    • https://cdn.sqhk.co/zuxafopagad/Laie6yl/48274739589.pdf
    • http://plafond.xyz/ejercicios_con_numeros_primos_y_compuestosrpc70.pdf
    • https://cdn-cms.f-static.net/uploads/4388283/normal_60567485685c7.pdf
    • https://cdn-cms.f-static.net/uploads/4487432/normal_605af83819112.pdf
    • http://tehnopolis.org/how_to_give_yourself_a_love_tarot_reading3xdze.pdf
    • https://cdn-cms.f-static.net/uploads/4409421/normal_602680687985c.pdf
    • http://detonic-shop.website/wirilajetotugufobebixorijw5f3f.pdf
    • https://static.s123-cdn-static.com/uploads/4491946/normal_5ff87f12d8335.pdf
    • https://cdn.sqhk.co/rudugebakivo/iahfjaX/gangstar_city_game_download_apkpure.pdf
    • http://price-list.moscow/85375816890o5jc2.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.indictrans.org
    • https://uploads.strikinglycdn.com/files/98f44cbe-cd49-40a8-b644-92a57a254491/fuxapojazisivokali.pdf
    • https://s3.amazonaws.com/zodawanuror/rufuxulon.pdf
    • https://uploads.strikinglycdn.com/files/e32bbfbc-4ea9-4348-82cc-b587e0331166/bakery_business_plan_sample_in_nigeria.pdf
    • https://uploads.strikinglycdn.com/files/16931df2-189b-4398-b5f1-82b1bba4fdad/how_much_are_air_force_1_at_foot_locker.pdf
    • https://f621ecf8-e26c-4db3-9bdf-176eeceb312d.filesusr.com/ugd/b3755e_38ae1a8c477e4894afc2fc198ced9370.pdf?index=true
    • https://69a7f268-727d-4112-ba4f-a3538cc856be.filesusr.com/ugd/9a0d60_24ca95139082442cbf534921bf872ea9.pdf?index=true
    • https://uploads.strikinglycdn.com/files/789d310e-b94b-4b61-9394-3e513bb31b10/nufimefadizanuduwodiwesat.pdf
    • https://s3.amazonaws.com/pevarijidasalop/is_arris_sb6141_compatible_with_xfinity.pdf
    • https://1e16f6d7-285b-4488-bf07-d3e24ac90e20.filesusr.com/ugd/417718_260415d4b06a4a9aaec8e941f23f96cb.pdf?index=true
    • https://712e085e-8422-4094-ae2e-709d430f1fc9.filesusr.com/ugd/bf8edb_2dd65947a6f54035aadc91d4e3b3db7e.pdf?index=true
    • https://s3.amazonaws.com/tutapaxi/edge_browser_for_windows_7_filehippo.pdf
    • https://s3.amazonaws.com/povelenavuviw/vector_jigsaw_puzzle_template.pdf
    • https://6d1a2d78-ebd2-4140-94a0-411197be5b5f.filesusr.com/ugd/88ff89_d493e85bd13243c3b6737071c0896214.pdf?index=true
    • https://s3.amazonaws.com/jejulurowev/best_rb_ballads_of_the_2000s.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec23.bin
d88dabe9cbf26d25e3b29b34c398addf48f8cf0c1210bab9aa3b1e6ac51e9952
pdf-font-stream PDF embedded font (sfnt) at offset 0xEC23 5440 bytes
font_01_sfnt_off0000feaf.bin
7f3b76f73377885dde258c792ec7c4c54b22785dfa1d0bcfe5ad1d03e970bea6
pdf-font-stream PDF embedded font (sfnt) at offset 0xFEAF 16004 bytes