Malicious PDF — malware analysis report

Static analysis result for SHA-256 723264e29075086f…

MALICIOUS

PDF

107.7 KB Created: 2021-04-05 22:04:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 6168209d2f921145315b5e17ad543164 SHA-1: a9ae08565ef0d680fec968b979c6aba6f1cb1d05 SHA-256: 723264e29075086fcb1047bcead2962d69330eb44925c00fe174a1eb659919c9
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The embedded URL, 'https://leonvi.ru/123?utm_term=designated+survivor+episodes+guide', is likely part of a phishing or social engineering scheme to direct users to a harmful site. While no scripts were explicitly extracted, the PDF structure and the presence of external URIs suggest it may contain embedded JavaScript or exploit code to facilitate the attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/123?utm_term=designated+survivor+episodes+guide PDF link annotation
    • https://cdn.sqhk.co/mugegiduveb/EcjhigF/cash_frenzy_slots_casino_reviews.pdfIn PDF document text
    • http://damomemisogadex.iblogger.org/banting_red_list_2019.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/kozewuposoridil/zuwat.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2b8de41a-cf42-4f4a-b676-6a1b26d81c8d/how_to_write_an_introduction_for_an_analysis_of_a_poem.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/01deebd8-17ae-4db8-ae57-83c4417354a6/le_petit_nicolas_chapitre_11_summary.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4455800b-5125-41ec-80d2-372e9a480a2b/56504212133.pdfIn PDF document text
    • https://s3.amazonaws.com/moduxanakuri/43590245276.pdfIn PDF document text
    • http://merofis.epizy.com/zulimepedibomi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/949c805f-7308-4c23-ac0e-e93c11abd3fc/83025767053.pdfIn PDF document text
    • https://s3.amazonaws.com/xamibebulosaxug/what_is_the_best_compliance_certification.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/661b1084-68e8-4beb-8397-6b64bd49bdab/good_adjectives_to_describe_a_forest.pdfIn PDF document text
    • https://s3.amazonaws.com/ruzumeb/juripebivugaz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d8bac844-5550-4e3d-be8b-2927bde7ad33/ionic_pro_compact_air_purifier_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/tubukeganuji/aperture_software_mac.pdfIn PDF document text
    • https://s3.amazonaws.com/penale/android_bottom_sheet_dialog_show_full.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00015401.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15401 6444 bytes
SHA-256: 4f6c4e3e388cbf98e1181976ff8e1b3610436747974adb3432106729574f6313
font_01_sfnt_off0001699e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1699E 5152 bytes
SHA-256: 2aab9c79c5621ba93cc024c03f65bb4517b7cc0b87fa84d8eb2bde6883fd9e53
font_02_sfnt_off00017b47.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17B47 11260 bytes
SHA-256: 8a3d9fd74d36e8d16ead088aa556ef5a7992c511516a84c741027fb5725846b3

Open this report in the interactive analyzer, or submit your own file for analysis.