Malicious PDF — malware analysis report

Static analysis result for SHA-256 7076008efad52ee9…

MALICIOUS

PDF

79.6 KB Created: 2021-03-19 10:45:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c90357df096aa5048087943c9edd5772 SHA-1: 2a6b0727d2d23e2dbc0792032b2161e8ea64c3b2 SHA-256: 7076008efad52ee992dd8c3379cdf72c02c5f7f6a755746c460f0b21b064eb69
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, appears to contain text related to audio interfaces, suggesting a lure to trick users into visiting the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=scarlett+18i20+3rd+gen+vs+clarett+8pre+usb
    • https://cdn-cms.f-static.net/uploads/4417023/normal_600a1901828fa.pdf
    • http://salonapp.xyz/approve_employee_timesheetsp5ocr.pdf
    • http://baby-slings.ru/science_of_logic_marxists4a6xp.pdf
    • http://helpcenter.business/jutedufiv473xt.pdf
    • http://samelike.site/7072435550045sns.pdf
    • http://netewe8.xyz/mupiferaliketmf3e.pdf
    • https://cdn-cms.f-static.net/uploads/4488316/normal_60490797a27fd.pdf
    • https://cdn-cms.f-static.net/uploads/4390642/normal_6028953f8ebd8.pdf
    • https://cdn-cms.f-static.net/uploads/4376380/normal_60446810e7abb.pdf
    • https://cdn-cms.f-static.net/uploads/4501495/normal_602542768cb62.pdf
    • https://static.s123-cdn-static.com/uploads/4374851/normal_5ff7d8f8353a8.pdf
    • https://static.s123-cdn-static.com/uploads/4481155/normal_6004066979f43.pdf
    • http://ipoteka.net/what_would_cause_my_dryer_not_to_heatx7d2z.pdf
    • http://swiss-family.space/life_cycle_of_anthocerosbk4pr.pdf
    • http://wowmarket.info/41545620708qsmck.pdf
    • http://storeyou.store/salon_de_belleza_mario_bellatin_analisis_literarioi8n86.pdf
    • http://giftcard-sale.store/what_are_the_12_rules_for_radicalsgrtff.pdf
    • http://investmag.org/excel_spreadsheet_project_budget_templatevqzza.pdf
    • http://sebezedamewem.iblogger.org/bededolasipevajuxi.pdf
    • https://cdn-cms.f-static.net/uploads/4455902/normal_601bfce15841a.pdf
    • http://hdsamara.ru/zejazuroropoluzormq1f.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://lebozid.epizy.com/89011266439.pdf
    • http://kojosire.epizy.com/64736899714.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f5f3.bin
f55ac4831a370c541afba18b2add2b9087b72ae5f26167d10a8402ed0d9bffe0
pdf-font-stream PDF embedded font (sfnt) at offset 0xF5F3 6228 bytes
font_01_sfnt_off00010b2b.bin
df614e8d7e96b542a568fd6497d47b7c20659253b6d0837d5671450e4e72a1cc
pdf-font-stream PDF embedded font (sfnt) at offset 0x10B2B 10992 bytes