Malicious PDF — malware analysis report

Static analysis result for SHA-256 716bf5be74dfa82e…

MALICIOUS

PDF

223.2 KB Created: 2021-03-14 20:06:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6e57b09d69c7835b6e90d908c0cfb046 SHA-1: d96171444155228f8150bcd2d829b76c1b55641c SHA-256: 716bf5be74dfa82e8e142505f8238258e9554a28c57134ca28bbe5c4b16912cf
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, 'dafemum.ru', which is likely used to host a malicious payload or phishing content. No scripts were extracted, but the presence of an external URI in a PDF is a strong indicator of malicious intent, often used to download further stages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9957

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/123?utm_term=qasida+burda+sharif+with+translation
    • https://susawodaf.weebly.com/uploads/1/3/2/8/132814942/zemumenu.pdf
    • https://kawikixefi.weebly.com/uploads/1/3/5/3/135388441/zufologedogin.pdf
    • http://lelonul.iblogger.org/99757800283.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://30c74dc1-c3f2-4e71-8253-1ec84f3b94e1.filesusr.com/ugd/b8c6fa_75f37cf3c3f346f8a9d67421c55f2f42.pdf?index=true
    • https://e2604e0b-f95a-4acb-b53f-a7db3827b2a1.filesusr.com/ugd/225520_56e897c4f26a4b029ea1d23e35834e1c.pdf?index=true
    • http://nojatajof.rf.gd/nomalabagovadalogep.pdf
    • https://a52dd608-e7dd-4d50-8005-e0fd7a3896b4.filesusr.com/ugd/43d2fc_dac32f9abee14381b3b097d2e36bcb6b.pdf?index=true
    • https://s3.amazonaws.com/juduk/certificate_of_analysis_template_ema.pdf
    • http://fulovefodib.epizy.com/54258088274.pdf
    • https://c7972686-9310-4d97-8ac3-15e828887225.filesusr.com/ugd/8a419d_ccdea2d468f942d5b1fe3fc054cc3b59.pdf?index=true
    • https://s3.amazonaws.com/bisapovepizaj/year_4_comprehension_worksheets_free.pdf
    • http://dozudaz.epizy.com/xizutojagivudeva.pdf
    • https://uploads.strikinglycdn.com/files/45c0893c-0dd0-43f3-ab45-58a06a5685c4/how_expensive_is_rosetta_stone.pdf
    • https://b70645e9-42d7-44c6-80f2-f165c8819e8d.filesusr.com/ugd/3f1130_7470981fc906414b811142bfc8bd0ac0.pdf?index=true
    • http://joboberunora.rf.gd/clasificacion_de_cuentas_de_ingresos_costos_y_gastos.pdf
    • https://45b0b119-5f8c-43e7-b437-4e12d17c1c81.filesusr.com/ugd/3826db_f71a7cf9e00845a8a4943b94cea7a347.pdf?index=true
    • https://uploads.strikinglycdn.com/files/428ca33e-42a6-489c-8b8e-665120f56286/82007625196.pdf
    • https://59548cc9-d6a6-4b2e-bd73-2bfb7290c7b5.filesusr.com/ugd/3fd21f_d1c08362749d4b95884d1afbc9a2425b.pdf?index=true
    • https://4bf641bf-117a-4913-931f-55e49063997f.filesusr.com/ugd/5befcb_5a40630370c94e55b5cf0a22ab428b55.pdf?index=true
    • https://95043331-d9de-4498-ad98-35b8ac3ee23f.filesusr.com/ugd/5740b2_5301d962e9f54611874ed421c836c461.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off00033202.bin
27d2770ef5b6fe1b0bad1f0179150179ff087093f69190b1b14056c0da5cdc57		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x33202 35244 bytes
font_00_sfnt_off0002f94a.bin
01ff7ca0d983f0508424ab0575634c32ea4d24fbc8b1d141f282e0ed09d4999c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2F94A 5288 bytes
font_01_sfnt_off00030b4d.bin
3144012915ef869047aa4de36c4851c245185e6091f2c8bec85813997361c9a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x30B4D 11520 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.