Malicious PDF — malware analysis report

Static analysis result for SHA-256 72c540d93470d044…

MALICIOUS

PDF

198.6 KB Created: 2021-04-16 22:42:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 979f260d2747812e956a0ebb7ff41533 SHA-1: e03a1ed2e5ee610e7a605b8505c640f31551dae7 SHA-256: 72c540d93470d044c4ac509e20ff47b757b468b4f22a925c8ffdb8665900999c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, which is likely used to deliver a malicious payload or redirect the user to a phishing site. The document body, though heavily obfuscated, appears to be a lure related to search results.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9892

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=define+social+realism PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4480884/normal_601dafb9eb488.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387218/normal_6031e46d17956.pdfIn PDF document text
    • http://xosubowavenu.mypressonline.com/47323549116.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4482869/normal_6068131f975fc.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4389606/normal_5fc6aefd3e5b5.pdfIn PDF document text
    • http://wapajag.22web.org/3314337601.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4418180/normal_60074e8055213.pdfIn PDF document text
    • http://wapadax.scienceontheweb.net/97628906956.pdfIn PDF document text
    • http://nesorus.mywebcommunity.org/what_are_the_different_types_of_contrast_in_art.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4475382/normal_5fe83252c56a2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417129/normal_604662096d138.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4372376/normal_5fce5f6ff30dd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409827/normal_601b2ff192bac.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://a0bbd489-bf03-48a0-8e93-88abd0751e5b.filesusr.com/ugd/370ea2_892345bee15d4b83b3d7066b7bfd81ce.pdf?index=trueIn PDF document text
    • https://b3079848-b07e-4d89-9244-05dfa5dd91fe.filesusr.com/ugd/3ab5ed_5374f42730db4700b1ce356064a5651d.pdf?index=trueIn PDF document text
    • https://ff999131-262c-4f46-aa1e-84c50d3d9e43.filesusr.com/ugd/a474dd_517f0bec90dc4e419a08832ebfe61961.pdf?index=trueIn PDF document text
    • https://77701ba7-c5ad-4750-ab17-5b03548f7fc0.filesusr.com/ugd/9a242c_be772ee9dbe04a48943630aec847b43f.pdf?index=trueIn PDF document text
    • https://8ed7b8cb-9bae-4def-ad9b-66b28cd11f91.filesusr.com/ugd/740d8c_f4c6e94066ff45209a9fea2399753d22.pdf?index=trueIn PDF document text
    • https://4121a797-204a-431c-92a8-8e24072fb342.filesusr.com/ugd/b972d5_8414b2cd010d4579a432acd238f72daf.pdf?index=trueIn PDF document text
    • http://tebokemirutexus.rf.gd/data_structures_and_algorithms_for_python.pdfIn PDF document text
    • https://eaa62ee9-779c-4a2d-9f50-6c66b019a99c.filesusr.com/ugd/1cc777_b825fd1f1d214bef960c06921446a904.pdf?index=trueIn PDF document text
    • https://52a72965-a6d2-471e-b66a-59a59a4d663b.filesusr.com/ugd/e643da_5ca36cf7e9cf48b591a2508ee8b8077c.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002cc29.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2CC29 5024 bytes
SHA-256: 434d22f749e26bbc0e404942157048b1dbd79567ffe6326c3dca134ffec362e6
font_01_sfnt_off0002dd35.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2DD35 15376 bytes
SHA-256: 752286b507aed15fa026a8d583f811ec94f361470eb932ff45fe83a07d793453

Open this report in the interactive analyzer, or submit your own file for analysis.