Malicious PDF — malware analysis report

Static analysis result for SHA-256 7274a541aba9397d…

MALICIOUS

PDF

71.9 KB Created: 2021-03-15 07:15:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 185dc995f3cfc0365784d495632440b6 SHA-1: 4fdb0a9c406d301f9782207484822c22a0ebf0f7 SHA-256: 7274a541aba9397d6ffc0f4029177c74611e35db4e3fceed0d7be949aeb1c733
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file contains multiple invisible links that lead to a URL designed to deliver a payload. The heuristic PDF_REPEATED_PAYLOAD_LINK_LURE specifically identifies this behavior, and the embedded URL is the primary indicator of compromise. The ML classifier and ClamAV detection further support the malicious nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE
    PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wix?keyword=volume+of+prisms+and+cylinders+worksheet+answers+math-aids.com In PDF document text
    • http://shoppermarket.online/sirozidijilitrhb.pdfIn PDF document text
    • http://okrasote.info/86444058201r8fm5.pdfIn PDF document text
    • http://vijufik.iblogger.org/runup.pdfIn PDF document text
    • http://vurejowug.mypressonline.com/35112988353.pdfIn PDF document text
    • http://xepuxupipe.mywebcommunity.org/why_is_fridge_leaking_water_inside.pdfIn PDF document text
    • http://boevoenlp.com/49090256062ntyyb.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/zomuzigo/manual_paper_cutting_machine_15_20.pdfIn PDF document text
    • http://pubejasebalodo.rf.gd/brutus_bula.pdfIn PDF document text
    • https://s3.amazonaws.com/jafujasiwetid/cara_bobol_wifi_indihome_hp_android.pdfIn PDF document text
    • http://dasobiviwadodaj.atwebpages.com/vuseperutowasuvavizitebog.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/199669e2-80e5-4722-9f32-831f0271b603/37836471476.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7afb602d-f941-4f95-924e-0813189aa87a/tipipifusileramukavatuji.pdfIn PDF document text
    • https://s3.amazonaws.com/votuweroxigezog/civ_5_korea_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/xukanomarexumu/v_tr_carl_sagan.pdfIn PDF document text
    • http://womusosixedel.epizy.com/66150692523.pdfIn PDF document text
    • https://s3.amazonaws.com/vavale/82755225334.pdfIn PDF document text
    • http://gisunomadipoxas.epizy.com/redowonomow.pdfIn PDF document text
    • http://tekusuzuxap.rf.gd/zurabanisonozigavufekumex.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/185a407b-886e-42f1-bf35-7b732c35fee7/87782639451.pdfIn PDF document text
    • http://ratobewiwigu.atwebpages.com/88457922155.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b1354ed9-4a64-4ca5-a5b4-a169c9640b9a/how_to_do_single_crochet_left_handed.pdfIn PDF document text
    • https://s3.amazonaws.com/kakekojezutok/reflections_translations_and_glide_reflections_worksheet_answers.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dbc9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDBC9 5680 bytes
SHA-256: 85ebc5acd062285728025a4c50c5d867cf3da6f802d081cccf67c5d7a6547f48
font_01_sfnt_off0000ef18.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF18 10288 bytes
SHA-256: 4a7e450601cad272fb935d8242adbb4ed9a832c7b02a4acd4fa448f977a2ed5d

Open this report in the interactive analyzer, or submit your own file for analysis.