Malicious PDF — malware analysis report

Static analysis result for SHA-256 685f3426f7b0a3c3…

MALICIOUS

PDF

83.8 KB Created: 2021-03-25 07:26:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 95bb7527eb1cf5279237a30c695d187e SHA-1: a889644feb284d1a2ac19ddbc438055c27cdb949 SHA-256: 685f3426f7b0a3c3bb91275bdd67a3c22bd815aa7a3065c4010691b8b76858d6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI that directs the user to a suspicious domain, disguised with a search query. This indicates a phishing attempt to trick users into visiting a malicious site. The ML classifier and ClamAV detection strongly support the malicious nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/award?keyword=radioactive+waste+treatment+pdf
    • https://xuwogufovesuvem.weebly.com/uploads/1/3/1/4/131406895/vedeparotobepiv_nobamibexut_gulev.pdf
    • https://lufojujerap.weebly.com/uploads/1/3/4/4/134481619/jilipa-pizuvupanifo.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://roxubimolileko.epizy.com/tibibe.pdf
    • https://c01188fd-d8af-4b86-846b-090f7ecd58d8.filesusr.com/ugd/9058e5_9e6066d6c4214388a74be663266c7df0.pdf?index=true
    • http://melamodusede.rf.gd/91705630673.pdf
    • http://gerodusiwisegog.rf.gd/excused_absence_form.pdf
    • https://s3.amazonaws.com/difigomisosak/job_performance_appraisal_templates.pdf
    • https://s3.amazonaws.com/kelukakeb/facebook_messenger_apk_por_uptodown.pdf
    • https://uploads.strikinglycdn.com/files/710a4cf3-f814-4dd5-ba89-976fae8d4a51/al_quran_al_karim_mushaf.pdf
    • https://1423d76f-a56f-4481-bf87-726e17039346.filesusr.com/ugd/14aee2_892c21d708314ac0be6ac032434f2d83.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e668754c-4151-464d-92c4-58f9a77ec2ab/86685506219.pdf
    • https://40fd9d30-e691-4ad4-9ff9-7de67b304886.filesusr.com/ugd/45b27a_37c1f052232944d39285538586c16425.pdf?index=true
    • http://xukosebufeli.rf.gd/zedibijosagari.pdf
    • http://tizoxojuragato.epizy.com/puedo_superarme_bernardo_stamateas_gratis.pdf
    • http://xamutakuf.epizy.com/49547151875.pdf
    • http://lirolisol.epizy.com/the_very_hungry_caterpillar_full_book.pdf
    • https://uploads.strikinglycdn.com/files/ff5614c0-f3a0-427b-877a-4d62a14f962a/how_to_replace_the_handle_on_my_ge_microwave.pdf
    • https://s3.amazonaws.com/jemisajoda/business_newsletter_templates_microsoft_word.pdf
    • http://zomojafo.epizy.com/vazugunatasafakureviruka.pdf
    • http://lumuwejonalar.epizy.com/blood_pressure_measurement_guidelines_2019.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001086e.bin
71d5a229eddbfe057e932adade6ed2d08898ac02130f3615935288d6b2ad4f03
pdf-font-stream PDF embedded font (sfnt) at offset 0x1086E 5428 bytes
font_01_sfnt_off00011ae9.bin
7d518d3f52f4ba514201ddc9674afeac8ce4174171963dfb21dacd855319575e
pdf-font-stream PDF embedded font (sfnt) at offset 0x11AE9 11396 bytes