Malicious PDF — malware analysis report

Static analysis result for SHA-256 702ce31103118bfe…

MALICIOUS

PDF

75.6 KB Created: 2021-03-16 17:26:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-30
MD5: 7a3c6aeb742e590ba72accb1380853db SHA-1: fbcf4da1338e698d1e7f2ff1230aa0c7dd67231d SHA-256: 702ce31103118bfe22b3d9462cd0b5e24169aa96d68e35fbf72caccd7c925c3f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a critical heuristic firing for ClamAV detection. An external URI pointing to 'maypoin.ru' was extracted, suggesting a phishing or malware distribution attempt. The PDF structure and embedded content, though heavily obfuscated, indicate an attempt to disguise malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/award?keyword=anemia+en+el+peru+2020+pdf PDF link annotation
    • https://cdn.sqhk.co/nodujugebi/gjz81ij/will_hitting_your_head_cause_seizures.pdfIn PDF document text
    • http://jadogaxarabu.mygamesonline.org/3_letter_airport_codes_nz.pdfIn PDF document text
    • https://cdn.sqhk.co/gujowaxexag/B83jdp4/snes_mini_wireless_controller.pdfIn PDF document text
    • http://rovanenafet.getenjoyment.net/how_do_you_turn_ringer_off_on_vtech_cordless_phone.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/nuselufuzo/84380462637.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f6bd45b9-7191-4fe3-8ab0-f844b1660ff7/the_flower_of_life_pendant.pdfIn PDF document text
    • https://s3.amazonaws.com/rogugagatuf/rr_watch_anime_online_apk.pdfIn PDF document text
    • https://s3.amazonaws.com/penale/ach_authorization_form.pdfIn PDF document text
    • https://s3.amazonaws.com/sogovekevi/33440680931.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9731adc1-e98f-4365-898d-14d1146159d5/the_great_gatsby_chapter_2_study_questions_and_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/10161fa1-8bdc-48cf-9a4b-6245d35f633c/toro_850_super_blower_vac_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1cab8b23-3ffd-480b-a559-9667d75b4f55/42397957814.pdfIn PDF document text
    • https://s3.amazonaws.com/sivanira/angry_neighbor_mod.pdfIn PDF document text
    • https://s3.amazonaws.com/kexamoxusinixu/resuforuvigerikanow.pdfIn PDF document text
    • https://s3.amazonaws.com/bofake/wasamuvatalede.pdfIn PDF document text
    • http://kutoxinupuroxo.onlinewebshop.net/acid_reflux_treatment.pdfIn PDF document text
    • http://tavamikilav.myartsonline.com/16514818588.pdfIn PDF document text
    • http://ketabigumowun.atwebpages.com/what_are_camera_shots_in_film.pdfIn PDF document text
    • https://s3.amazonaws.com/vibuvomomuv/voveroxifaputa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/927a13eb-782c-4813-a622-db07263387a9/24410325753.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e668.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE668 5272 bytes
SHA-256: 5e2cc810f39e547e1a87940d59aae61372fea3ce1856508e94c907be36aba04f
font_01_sfnt_off0000f83c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF83C 12280 bytes
SHA-256: 8ac08e15bb7c9822ee66952ba9c88edc84e4d8fc68ae7f5dbf4d650edc205dfa

Open this report in the interactive analyzer, or submit your own file for analysis.