Malicious PDF — malware analysis report

Static analysis result for SHA-256 745fa06cb1cd4935…

MALICIOUS

PDF

93.6 KB Created: 2021-04-07 03:19:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bc0d2e2352d9316020451dffa9b3cc91 SHA-1: c64469945681cddf3f81c340f2be591bd7ea976e SHA-256: 745fa06cb1cd4935ac80294801cf6d142b0619760f828eda12cb958a0a7721ba
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating it is a phishing or trojan delivery attempt. It contains an embedded URL pointing to a suspicious domain, likely intended to host a malicious payload or redirect the user to a phishing site. The document body, though heavily obfuscated, suggests a lure related to 'carcassonne game pieces pdf'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/award?keyword=carcassonne+game+pieces+pdf
    • https://cdn-cms.f-static.net/uploads/4463812/normal_60301fad4526c.pdf
    • https://static.s123-cdn-static.com/uploads/4456685/normal_5fddb76e23255.pdf
    • http://wivaserana.mywebcommunity.org/how_long_do_rayovac_batteries_last_in_a_xbox_controller.pdf
    • http://nokasosozigof.mypressonline.com/86859747002.pdf
    • https://static.s123-cdn-static.com/uploads/4408588/normal_5fcda1e0b494f.pdf
    • http://ditoterelutas.sportsontheweb.net/how_to_make_bookmarks_appear_automatically_in.pdf
    • http://rawitotizoxuk.scienceontheweb.net/beregepabapodawis.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/74584218-2aa8-41f8-b5a1-441a6100cfb0/fulasogenazuvow.pdf
    • https://uploads.strikinglycdn.com/files/e09d92bc-a2f8-4e68-bde6-8c9f75fd709d/how_to_use_a_oil_filled_radiator_heater.pdf
    • https://uploads.strikinglycdn.com/files/9f10b1f8-4ecd-4f46-8a50-e4c0acbf88fa/71082124747.pdf
    • https://uploads.strikinglycdn.com/files/65a2e28c-2ec5-4f49-95b3-2b7817aca85b/solucionario_del_libro_principios_de_economia_de_gregory_mankiw_sexta_edicion.pdf
    • http://gepikadagutuv.epizy.com/atualizao_azbox_bravissimo_twin_transformado_julho_2019.pdf
    • http://nezopodadas.epizy.com/87783203683.pdf
    • http://jojulupijawide.onlinewebshop.net/cahier_de_vacances_college.pdf
    • https://uploads.strikinglycdn.com/files/ca41c22d-11cc-4a1f-a6ba-80f1d3085fc9/brother_cs5055prw_project_runway_limited_edition_computerized_sewing_machine_white.pdf
    • http://duvubatas.rf.gd/jesonika.pdf
    • https://uploads.strikinglycdn.com/files/cfd57617-f4ba-4586-b059-d5ca988b495e/the_heirs_season_2_sub_indo_full_movie.pdf
    • https://uploads.strikinglycdn.com/files/5474aa53-d347-4ccc-a418-36248857592f/83997094655.pdf
    • https://uploads.strikinglycdn.com/files/7e0c1e0e-69d0-4016-b23e-689193ebcccd/92603007407.pdf
    • https://uploads.strikinglycdn.com/files/7741afe4-9bb8-4ed1-ad14-0e2cea6f4498/xamawarokabobes.pdf
    • http://vurorevebosexu.rf.gd/el_camino_parents_guide_2019.pdf
    • https://uploads.strikinglycdn.com/files/e46796e8-4701-432b-b447-eca5a786458f/how_to_write_your_college_essay_in_one_day.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000120e7.bin
f90ddbd30bfab5ca7d915824669091fca92ff8374e86a2a5b07ce609f2fbaf75		 pdf-font-stream PDF embedded font (sfnt) at offset 0x120E7 5176 bytes
font_01_sfnt_off0001325f.bin
0aeef2b22b62aab80cf33fd4d6015cca877995fd72876657fc6b5add827c4002		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1325F 12516 bytes
font_02_sfnt_off00015abb.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15ABB 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.