Malicious PDF — malware analysis report

Static analysis result for SHA-256 75716ecb541fd74f…

MALICIOUS

PDF

76.6 KB Created: 2021-03-25 04:04:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: eab6d18ec72f38c260d1036bbd287f2e SHA-1: 1612e780e6cea05533fbec3394391b132d2c00a6 SHA-256: 75716ecb541fd74feeb73699ba2a4bfdbaa1c4840a2802c173770353b2826bd7
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, vilenefex.ru, which is likely intended to host a malicious payload or phishing page. The document body, though heavily obfuscated, suggests a lure related to 'information literacy skills' to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/aws?utm_term=what+are+the+information+literacy+skills
    • https://static.s123-cdn-static.com/uploads/4408464/normal_600057e1bc513.pdf
    • https://cdn.sqhk.co/zijatiki/Khboihu/81175546352.pdf
    • https://cdn-cms.f-static.net/uploads/4490724/normal_6031494719959.pdf
    • https://cdn-cms.f-static.net/uploads/4501206/normal_6046fb3a48d1c.pdf
    • https://static.s123-cdn-static.com/uploads/4461229/normal_5fce236a3d0e4.pdf
    • https://cdn.sqhk.co/xobupiba/gjjaiiT/wrestling_revolution_3d_pc_download_free.pdf
    • https://static.s123-cdn-static.com/uploads/4450721/normal_5febcd37f2577.pdf
    • https://static.s123-cdn-static.com/uploads/4408187/normal_5feb617f32546.pdf
    • https://cdn-cms.f-static.net/uploads/4464315/normal_6049491c0604b.pdf
    • https://cdn.sqhk.co/semiwewedazi/1ljdjil/super_miner_grow_miner_apk.pdf
    • https://cdn-cms.f-static.net/uploads/4369916/normal_600f91e634745.pdf
    • https://static.s123-cdn-static.com/uploads/4478131/normal_5fc7e92701776.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/a854ab30-b85e-4f25-aa1f-c6a51ef0818a/vw_maintenance_schedule.pdf
    • https://uploads.strikinglycdn.com/files/fc536ca2-bdc1-4da2-90de-7c850196f9a7/skilsaw_mag_77_replacement_cord.pdf
    • https://uploads.strikinglycdn.com/files/7138b0e8-3b42-440c-873f-7c40356d526d/midnight_sun_full_movie_online.pdf
    • https://uploads.strikinglycdn.com/files/cecab540-f4d9-4398-8c41-34cc35272e6b/how_to_pick_peanuts_in_hay_day.pdf
    • https://uploads.strikinglycdn.com/files/a9b39358-0248-4994-8205-185b189066f3/gukif.pdf
    • https://uploads.strikinglycdn.com/files/70759b76-5288-4279-9911-576af1de46a4/is_it_worth_to_learn_android_development_in_2020.pdf
    • https://uploads.strikinglycdn.com/files/256431e6-78b2-491b-9cc0-2b119eaad008/binejemofumofozegowavuvud.pdf
    • https://uploads.strikinglycdn.com/files/c83bc9ba-52eb-4a8a-ab01-04b5e1219498/fifty_shades_freed_book_summary.pdf
    • https://uploads.strikinglycdn.com/files/479a9279-333b-4261-af3b-4a38c48a463a/41208624790.pdf
    • https://uploads.strikinglycdn.com/files/6ea3128e-bdbf-4a99-aa9f-8ea27c5071da/right_to_equality_before_the_law_meaning_in_hindi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eeb4.bin
7357b7a536dc98f1a746f83bbc276e23f033a41e5a3140c6bd61eced555f9352
pdf-font-stream PDF embedded font (sfnt) at offset 0xEEB4 5300 bytes
font_01_sfnt_off000100a7.bin
8ea8191213e45b23321bd8528a47fc17e1fd3aa43da08e7ee655bd175fae708e
pdf-font-stream PDF embedded font (sfnt) at offset 0x100A7 10620 bytes