Malicious PDF — malware analysis report

Static analysis result for SHA-256 6bd8a0e1a7357cea…

MALICIOUS

PDF

84.2 KB Created: 2021-05-19 07:01:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1f9b6e29190e847ce8e91ae938bc7806 SHA-1: 78b8c3774f37f58cb22ec50386974eb317d37a0a SHA-256: 6bd8a0e1a7357cea6fea802de50fd9b29c0ce90dda93044b9f5a4c3caf19c2ae
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, vilenefex.ru, which is likely intended to host a malicious payload or phishing page. The document body, though heavily obfuscated, suggests a technical pretext for the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=how+to+determine+metric+thread+pitch
    • https://static.s123-cdn-static.com/uploads/4412387/normal_5ff16b84c3821.pdf
    • https://cdn-cms.f-static.net/uploads/4392441/normal_604a77196cf32.pdf
    • https://static.s123-cdn-static.com/uploads/4490930/normal_5ff890eef0691.pdf
    • https://cdn-cms.f-static.net/uploads/4365584/normal_6068db9778342.pdf
    • https://cdn-cms.f-static.net/uploads/4494417/normal_5fe713bef194a.pdf
    • https://cdn-cms.f-static.net/uploads/4405443/normal_5fd673d95d126.pdf
    • https://cdn-cms.f-static.net/uploads/4387582/normal_6040302e375af.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/tugabijenovili/compare_and_contrast_two_stories_essay_example.pdf
    • https://s3.amazonaws.com/borokegujuzero/96226034109.pdf
    • https://s3.amazonaws.com/gowupuzokowuxes/44741869617.pdf
    • https://s3.amazonaws.com/lanubili/sentry_safe_lock_wont_open.pdf
    • https://s3.amazonaws.com/jivuxo/13217434050.pdf
    • https://s3.amazonaws.com/kefodek/frozen_songs_audio_free.pdf
    • https://s3.amazonaws.com/davolazupivowi/71605016682.pdf
    • https://s3.amazonaws.com/daxemo/gi_sheet_weight_calculator.pdf
    • https://s3.amazonaws.com/defipedibe/4308991501.pdf
    • https://s3.amazonaws.com/libosokune/65953501723.pdf
    • https://s3.amazonaws.com/zazelujeju/66295422694.pdf
    • https://s3.amazonaws.com/goneduzum/achieve3000_answers_soldier_in_the_wild.pdf
    • https://s3.amazonaws.com/vuliwisuwig/pixafesowufisiguves.pdf
    • https://s3.amazonaws.com/lovetijif/77320627181.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea4a.bin
357729ea9900df645b7a25b02bfba26036d45a3a68f929d3d12767d9f03325f9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA4A 2960 bytes
font_01_sfnt_off0000f495.bin
faf321c3084eba23d46309531896da72995a5aeb6e676173406624d8ef579507		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF495 5156 bytes
font_02_sfnt_off00010605.bin
37e0a9777a98df036a836547dcde9feed3f5cf28689c3c2e77db29e38fa25bc5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10605 11440 bytes
font_03_sfnt_off00012d9c.bin
0df469ace8b4ae32ddae26db737700b3392f1fb76fa011a6c64c309f4ff08844		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12D9C 16064 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.