Malicious PDF — malware analysis report

Static analysis result for SHA-256 6f50ba36b19a4802…

MALICIOUS

PDF

81.1 KB Created: 2021-03-29 21:41:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1926bc8d4c7be7b1c5a091e6dbc32989 SHA-1: e45d9b6dc8b74be0315ada2370e36c41c85df44a SHA-256: 6f50ba36b19a4802d4283a5ddaa3ff1319374d27db07677f73d135349d9ec72d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, pelibifir.ru, which is likely intended to host a malicious payload or redirect to a phishing site. The document body, though heavily obfuscated, suggests a lure related to reading levels, aligning with common phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=magic+tree+house+space+reading+level
    • http://cloudplay.xyz/kibojesegirofzjad.pdf
    • http://mscgis.net/16156773425hrjx2.pdf
    • http://solerizimifo.iblogger.org/auld_lang_syne_piano_chords.pdf
    • http://wepoxagu.22web.org/wuniputazewogidasulagiv.pdf
    • http://duzegotola.medianewsonline.com/piano_keyboard_notes_labeled.pdf
    • http://sedouche.xyz/fuzatoeeex6.pdf
    • http://vykupavto54.ru/what_is_biblical_perspective_of_safety4xu76.pdf
    • http://fegokodelaxen.scienceontheweb.net/c_interview_questions_edureka.pdf
    • http://lamovingcompany.com/un_curso_de_milagros_leccion_59k4g3v.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/gebukil/38972708025.pdf
    • https://uploads.strikinglycdn.com/files/3732d682-ce19-4d30-b382-0b683c16822b/wabutav.pdf
    • https://s3.amazonaws.com/likadojivivofu/major_climatic_regions_of_the_world.pdf
    • https://s3.amazonaws.com/wulagisi/6875484176.pdf
    • https://uploads.strikinglycdn.com/files/897bf0a7-4b63-4e9f-98b9-1a32acd31487/56781597990.pdf
    • http://sonapap.rf.gd/93985328276.pdf
    • https://s3.amazonaws.com/fidefofudi/prophet_sport_lipo_charger_error_codes.pdf
    • http://safagapoz.rf.gd/zuvexixixezijuwogojuwet.pdf
    • https://s3.amazonaws.com/wutezigojuxi/wejezakowanerigo.pdf
    • https://s3.amazonaws.com/vovabagubajegeb/naviburosufojenel.pdf
    • https://s3.amazonaws.com/tiniruru/widiwerijawoj.pdf
    • https://s3.amazonaws.com/kozewuposoridil/what_is_sarah_from_dance_moms_doing_now.pdf
    • https://uploads.strikinglycdn.com/files/8374b782-1d58-4df6-8fa0-5f2791da4e0b/what_is_the_best_school_for_computer_programming.pdf
    • https://uploads.strikinglycdn.com/files/330f574e-bfc0-4fa1-9646-40939b74e3fc/ms_word_cv_format_free_download.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eec8.bin
b4d8ee1d601c9500d90883278259521f0fad4afc216056e0a5979dadab8a0fcf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEEC8 5280 bytes
font_01_sfnt_off000100bc.bin
75f6564334aaaadd0fba103591e91c658b9336512740f165c1dc06e5854f07cd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100BC 11468 bytes
font_02_sfnt_off000126f3.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x126F3 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.