Malicious PDF — malware analysis report

Static analysis result for SHA-256 68465679a771d2bc…

MALICIOUS

PDF

83.7 KB Created: 2021-04-07 06:08:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 0583ab9c4adad2a8e0156d5ac4919fef SHA-1: 941dbe78d2fb7011885d2eb10a9bc33eca0686e9 SHA-256: 68465679a771d2bc8325399b3a01a87a7c07ddbf401545c422197683a6e61ea2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to a suspicious URL, which is likely a phishing lure. The document body, though heavily obfuscated, contains text related to search queries, reinforcing the phishing pretext.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=wordly+wise+book+6+lesson+7d+answers PDF link annotation
    • https://cdn.sqhk.co/kigoxeni/ifuqjar/fagekusijulu.pdfIn PDF document text
    • https://cdn.sqhk.co/suwajipufo/dnNqgjy/class_app_extends_component.pdfIn PDF document text
    • http://gugolufixa.mywebcommunity.org/al_quran_english_free_download.pdfIn PDF document text
    • http://vibolofisef.mywebcommunity.org/domox.pdfIn PDF document text
    • https://cdn.sqhk.co/lexebogefaj/iajcG3m/ghostery_privacy_browser_adalah.pdfIn PDF document text
    • https://cdn.sqhk.co/fiduzosi/gdga2Yf/72280362070.pdfIn PDF document text
    • https://cdn.sqhk.co/wobivada/hdifIid/68803511250.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/ac8a7005-196e-48f7-8133-7738a401905f/gta_san_andreas_superman_mod_cheats_codes_pc.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/56a7d897-a7b7-44b3-baa4-4578ebca77a0/stock_market_news_channel_in_hindi.pdfIn PDF document text
    • https://s3.amazonaws.com/rimejiguvif/nuninireluf.pdfIn PDF document text
    • http://wepogevadapafa.atwebpages.com/obituary_writing.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e3ef4ca5-9ae7-4455-869e-0e677c28b6cf/12719866588.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1e2bc105-6ff2-4f93-874b-7e05ca36181f/95494182662.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/37050237-0d16-4eac-86f7-aac6f3d92380/lenguaje_corporal_perros_imgenes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/76ab309d-8130-4c75-8592-5804c06ba8fa/adele_sheet_music_piano.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d8bc7c06-6a52-4e70-bb0f-67d5ffbd26ae/48551047795.pdfIn PDF document text
    • https://s3.amazonaws.com/veledabejufi/91689536788.pdfIn PDF document text
    • https://s3.amazonaws.com/wavunot/idioms_worksheets_for_grade_5.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/22fb0572-6fd0-46db-a648-a8024b1c37b5/from_critical_thinking_to_argument_a_portable_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/91dddb94-e60b-4324-9bee-3fa44fa0ea08/vibaxarimojefakelotoj.pdfIn PDF document text
    • https://s3.amazonaws.com/wutisigila/best_introduction_to_economics_textbook.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8c7fd749-2464-4141-ab05-0d341acd6642/vorinupakibinotedifoko.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f36e5001-2ef3-42b6-88d9-ef2630db43fe/58985774052.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/97921343-4689-4547-9626-db55c0feaeb2/how_to_print_from_iphone_to_hp_officejet_pro_8600.pdfIn PDF document text
    • http://zogadawedalifap.onlinewebshop.net/bahaya_rokok_bagi_perokok_pasif.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010ba4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10BA4 5464 bytes
SHA-256: 0437d793760169a190afa3d46db3f325d28422cd1231ad2a57e138ad4d1218fb
font_01_sfnt_off00011e6b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11E6B 10360 bytes
SHA-256: 2e8b55e0ad9b15689ef80d41783ab1a303068828b52c37b8ecc546b2844b6525

Open this report in the interactive analyzer, or submit your own file for analysis.