Malicious PDF — malware analysis report

Static analysis result for SHA-256 738079a8717c9e82…

MALICIOUS

PDF

86.4 KB Created: 2021-03-28 13:29:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 85f11cedaf4aa70b9ecb16f4d08ab28e SHA-1: d4788fe2bc608a4d5d71c345d8b86e320570d7ec SHA-256: 738079a8717c9e8214000796b607807f96fe30ea84fd75e6e4660e5f0536a9a4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, identified by ClamAV as 'Pdf.Phishing.Trojan'. The document body, though heavily obfuscated, suggests a lure related to 'ball badminton skills' and an award, likely to trick the user into visiting the malicious URL. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/award?keyword=ball+badminton+skills+pdf
    • http://yozi.store/what_is_aggregate_planning_what_are_the_objectives_of_aggregate_planningct12g.pdf
    • https://static.s123-cdn-static.com/uploads/4408177/normal_6008dc350828c.pdf
    • https://cdn-cms.f-static.net/uploads/4365567/normal_603f1162622b6.pdf
    • http://byt-upak.ru/90283769038k98ka.pdf
    • https://static.s123-cdn-static.com/uploads/4367644/normal_60059179b8614.pdf
    • https://cdn-cms.f-static.net/uploads/4388285/normal_602d00cba7ee1.pdf
    • https://cdn-cms.f-static.net/uploads/4369633/normal_605706f52717e.pdf
    • https://cdn-cms.f-static.net/uploads/4410015/normal_6049a3f7888f6.pdf
    • https://cdn-cms.f-static.net/uploads/4380694/normal_604e0c8f59f94.pdf
    • http://ch-redirect.icu/interpreter_of_maladies_book_review4gvjh.pdf
    • http://recepty-dd.info/access_control_system_software_free9tghi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/bc88353a-f15a-4a49-bb63-d9e1b0ba41cd/dirt_devil_power_stick_lite_4-in-1_corded_stick_vacuum_sd22030.pdf
    • https://uploads.strikinglycdn.com/files/3ef4a023-bb79-4673-b84f-8cab43498f14/nada_blue_book_for_used_cars.pdf
    • https://uploads.strikinglycdn.com/files/eec03061-a19b-4842-a581-e8554ffd9e38/what_is_the_first_agricultural_revolution.pdf
    • https://uploads.strikinglycdn.com/files/c5dab5d0-ac1f-4230-b086-2db6c0137463/83081510829.pdf
    • https://uploads.strikinglycdn.com/files/3a4d8bda-b4a3-4e20-9ba1-c2018b0d667a/xokobuvalorefiromasopas.pdf
    • https://uploads.strikinglycdn.com/files/945d4db9-7e5d-4995-aa0e-26af4c12ae74/vidibarub.pdf
    • https://uploads.strikinglycdn.com/files/7095415e-0be7-447c-accb-a2227ee1cc0c/dumafilug.pdf
    • https://uploads.strikinglycdn.com/files/527b029f-bb09-4c5d-b070-199469721c81/3491791228.pdf
    • https://uploads.strikinglycdn.com/files/d20d5f68-e334-4af8-91e4-47f975bf7a2e/snapper_riding_lawn_mower_specs.pdf
    • https://uploads.strikinglycdn.com/files/d3b4f5e6-2e38-4747-9d22-f26605ceb22c/insinkerator_badger_500_not_working.pdf
    • https://uploads.strikinglycdn.com/files/828d1b00-8066-4235-8c6e-26d1854e3a64/mefimunogubajuraso.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000109ac.bin
21cccb13e3f36529edfe0e5cc97e92a35506f1008750e5627e5c2a1393075793		 pdf-font-stream PDF embedded font (sfnt) at offset 0x109AC 5016 bytes
font_01_sfnt_off00011a94.bin
35977406a666935ae714dd3159a58f5447b69aa857eb55561a03a5ee4cba547c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11A94 10628 bytes
font_02_sfnt_off00013e68.bin
7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13E68 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.