Malicious PDF — malware analysis report

Static analysis result for SHA-256 6dad7ef252f270c9…

MALICIOUS

PDF

170.1 KB Created: 2021-03-19 12:25:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bc1aef2a377bdbaa2b7daea3b5bb04a6 SHA-1: 100d6c1b7808c5ca70a6cb37cd2c91033239048d SHA-256: 6dad7ef252f270c9668ab42ffe5fec01aa186709f4875e96e6220f81d02aea90
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://xezojetit.ru/award?keyword=bergson+time+and+free+will+pdf', suggesting a phishing or malware delivery lure disguised as a search result. No scripts were extracted, but the presence of external URIs and the overall detection profile strongly suggest a malicious document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/award?keyword=bergson+time+and+free+will+pdf
    • http://naturelofo.mypressonline.com/vulujodixejuzak.pdf
    • https://cdn.sqhk.co/ruwonumatag/Bgckbih/among_us_sabotage_sound_mp3.pdf
    • https://cdn.sqhk.co/verinomo/hboDjcb/bajaj_allianz_general_insurance_health_policy.pdf
    • https://vumorusumanipav.weebly.com/uploads/1/3/4/2/134234742/2056635.pdf
    • https://cdn.sqhk.co/tajiwikiter/aH3heib/blazetv_promo_code_free_speech.pdf
    • https://cdn.sqhk.co/novimabe/ZjfqJVr/scratch_for_ubuntu.pdf
    • https://lufosafol.weebly.com/uploads/1/3/0/7/130775677/jifevem.pdf
    • http://wotukujis.sportsontheweb.net/lizafewib.pdf
    • https://pafudufuwod.weebly.com/uploads/1/3/4/3/134326080/6566717.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/woneketelak/95941446425.pdf
    • https://uploads.strikinglycdn.com/files/bd6bfa3e-dd68-4a8d-8d78-4d625879b5a8/7126194754.pdf
    • https://uploads.strikinglycdn.com/files/110f4456-15d8-4cc9-830c-aa9751d0f644/watts_premier_ril-10.pdf
    • https://fd7a53fe-11c1-4e60-83ad-ac1bb997268f.filesusr.com/ugd/5cf23b_e60be6f4512048cf81cf70778946afb8.pdf?index=true
    • https://uploads.strikinglycdn.com/files/fd126fb5-0bf6-45ae-9c69-487120f83db8/16009303386.pdf
    • https://s3.amazonaws.com/rizijubovapuk/where_did_abstract_mathematics_originate.pdf
    • https://s3.amazonaws.com/vuraradaso/project_igi_2_apunkagames.pdf
    • https://d89a15f7-21b5-45f0-b9b4-bc5b7be68842.filesusr.com/ugd/18e821_958afb1ab1c649cab8407864c92333f9.pdf?index=true
    • https://uploads.strikinglycdn.com/files/d3b4f5e6-2e38-4747-9d22-f26605ceb22c/insinkerator_badger_500_not_working.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002636a.bin
37b8e8d8749ae4ccf3dd0918ed1dfc812321401e4845eab84cecd4560c968e61
pdf-font-stream PDF embedded font (sfnt) at offset 0x2636A 5504 bytes
font_01_sfnt_off00027623.bin
950eddc2faae9f28e26577887bb573d0429687729377abc17aa511871865ef53
pdf-font-stream PDF embedded font (sfnt) at offset 0x27623 10896 bytes