Malicious PDF — malware analysis report

Static analysis result for SHA-256 6849e20577e134d7…

MALICIOUS

PDF

77.8 KB Created: 2021-04-23 19:56:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b08bb2895a0dc4d53226079672b0c521 SHA-1: d8d9523d6378aacf59908b5fa30a5810f9c22e37 SHA-256: 6849e20577e134d76aa7652eaf08f65026ac9262adf2a6dd8206e175c4d66ad0
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site. The document body, though heavily obfuscated, appears to contain text related to search queries, supporting the phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=knee+scooter+repair+shop+near+me
    • http://wersita.space/what_story_is_game_of_thrones_based_onic2sx.pdf
    • http://akfb.online/43709039238hhn37.pdf
    • http://puveputado.sportsontheweb.net/bufilabosilivokusir.pdf
    • http://magic-spring.com/black_and_decker_lst136_trimmer_review403q9.pdf
    • https://senovaxevuka.weebly.com/uploads/1/3/5/3/135304629/8587026.pdf
    • http://fresh-ita.fun/nejomumevibip1xbms.pdf
    • http://normaa-id.com/fipoli7z13o.pdf
    • https://pijusutuwo.weebly.com/uploads/1/3/1/4/131407307/rorulikevotu_kabogufalinurut_wovivati_kidenabaweget.pdf
    • http://izzzaaa.space/22245357467yuc85.pdf
    • http://simopuvoramawu.mywebcommunity.org/22280791190.pdf
    • http://tibetterrier.ru/33389687470x4hin.pdf
    • http://manamuposa.getenjoyment.net/calendario_escolar_2018_y_2019_sep.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/5cd08006-f4c7-45b6-bb9e-2a50640ae353/pro_97_scanner.pdf
    • https://s3.amazonaws.com/rorives/dufajela.pdf
    • https://s3.amazonaws.com/masevewi/assessment_centre_exercises.pdf
    • https://uploads.strikinglycdn.com/files/b75869b7-14ad-401b-8298-5ae6eca7cac8/ziruredof.pdf
    • https://uploads.strikinglycdn.com/files/0fdf63f1-e1e2-40c5-8bba-2c7fa8dbeb40/how_to_install_canon_pixma_e510_printer_without_cd.pdf
    • http://gaxilitexu.onlinewebshop.net/gizowewubowanamarivexu.pdf
    • https://uploads.strikinglycdn.com/files/ffae3bb2-c5a3-4777-af18-9cb9cb546142/95855931608.pdf
    • https://s3.amazonaws.com/paxunu/banner_saga_2_apk_revdl.pdf
    • https://s3.amazonaws.com/xakajoziwibi/numbers_in_scientific_notation_worksheet.pdf
    • https://uploads.strikinglycdn.com/files/28938ed0-368f-4a1f-9911-3b1023f233d1/calories_arbys_french_dip_no_cheese.pdf
    • https://s3.amazonaws.com/panalipolifod/manual_mageweave_bandage_vanilla.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f48a.bin
c883f83ef3c5881a6334f7bf0d5105e050afa5025dc6b65048e30890b03b1bb7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF48A 5108 bytes
font_01_sfnt_off000105c6.bin
73b8de671cebe41d70e7e1f98457e654149fae53c4549d87670250556f01a0e9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x105C6 10468 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.