Malicious PDF — malware analysis report

Static analysis result for SHA-256 69c900b6dd91e59e…

MALICIOUS

PDF

130.2 KB Created: 2021-03-20 07:09:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 64738fb08479cfd3ca226029f8fc90e5 SHA-1: 9d07ba5526de01625794f3d6e53f8ea4c3ddf432 SHA-256: 69c900b6dd91e59e81b335c19ee12c3482a237b9e22603e78c5bf1e5d14d3fc8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classification and ClamAV, with a high risk score. It contains an embedded URI pointing to 'maypoin.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily corrupted, suggests a lure related to a 'TV guide'. The presence of numerous external URLs further supports the malicious intent of directing users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=tv+guide+st+pete+fl
    • http://bibivire.mygamesonline.org/sevojifago.pdf
    • http://xexapitanegis.getenjoyment.net/present_perfect_subjunctive_spanish_exercises.pdf
    • http://dotenipago.medianewsonline.com/singer_patchwork_sewing_machine_tension_problems.pdf
    • http://100naturals.fun/pokisaxevivekade5huxu.pdf
    • http://procripton.com/873925529244sn2q.pdf
    • http://xitawefavam.medianewsonline.com/76000606683.pdf
    • http://tixshopclub.fun/bosch_dishwasher_decor_door_fixing_kitjdkum.pdf
    • https://vepifedufonun.weebly.com/uploads/1/3/1/4/131454255/103868ff8a8e56.pdf
    • https://gegaminowudajun.weebly.com/uploads/1/3/4/0/134041134/3858209.pdf
    • http://bamirajewenexo.medianewsonline.com/demevafimi.pdf
    • http://trening-ekaterinodar.ru/juninururobasimebeje2rdk9.pdf
    • http://classkaod.ru/boohoo_meme_funnypbky4.pdf
    • http://bafiselavanebep.mywebcommunity.org/english_literature_textbook_high_school.pdf
    • http://scrlt.xyz/92217068748e0mlj.pdf
    • http://grenkasalo4.xyz/character_letter_template_word4y50c.pdf
    • https://wubinuju.weebly.com/uploads/1/3/4/6/134642725/mukaderobikamop-wuwilifig-nitiliwidexok-kiged.pdf
    • http://wogivodugakovek.mygamesonline.org/jojakajafunowegewevemad.pdf
    • http://de-bewertung-889562.icu/pride_and_prejudice_chapter_6_and_7_summaryiilen.pdf
    • http://pogawubujogeje.mypressonline.com/hp_officejet_5510_specs.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://kageditivumimor.onlinewebshop.net/mijail_bakunin_libros.pdf
    • https://s3.amazonaws.com/loxopudizus/buffalo_bills_final_injury_report.pdf
    • http://mawokale.myartsonline.com/fifazakepapesenufip.pdf
    • https://s3.amazonaws.com/pewibim/blood_pressure_medication_guidelines_uk.pdf
    • https://s3.amazonaws.com/kevava/bipukariximunasotexulexo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001bfaa.bin
ae0455ddba363543586b6af0854d98a464546b8af2eb51d1440b9df7a49ae71a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1BFAA 4912 bytes
font_01_sfnt_off0001d08b.bin
d70f2bbcab3107351c50c823e21dc3be408016a2d9388d78097312594d49a3df		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1D08B 12456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.