Malicious PDF — malware analysis report

Static analysis result for SHA-256 75a4fd0f144dae81…

MALICIOUS

PDF

71.0 KB Created: 2021-02-20 20:15:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6304008f29c0dac02b28803f5cc3da31 SHA-1: 249791da95db0cd106b3586335954e2f6d46e3c0 SHA-256: 75a4fd0f144dae81bb6891e1fe416e943141543e0f73c2afe3251ded4b923611
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. The embedded URLs suggest a phishing or malware distribution campaign, likely using the document body's text as a lure. The presence of multiple external URIs points to the document's role in directing users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=exodus+leon+uris+pdf+free+download
    • http://cocobuka3.xyz/45153674314q6prd.pdf
    • https://cdn-cms.f-static.net/uploads/4382193/normal_601830678d407.pdf
    • https://zegadakupoxak.weebly.com/uploads/1/3/4/7/134749069/c937f61b79afb.pdf
    • https://bitipares.weebly.com/uploads/1/3/1/3/131379103/vadakuruxoribavile.pdf
    • http://nofomox.22web.org/28182998589.pdf
    • http://xtina.online/black_panther_cast_2hpvsi.pdf
    • https://lifalaril.weebly.com/uploads/1/3/4/8/134883644/pixow.pdf
    • http://rodsfish.club/carvedilol_msdsuxk0t.pdf
    • https://static.s123-cdn-static.com/uploads/4421767/normal_5fc67d95a1595.pdf
    • http://korirojasutito.22web.org/19604202610.pdf
    • https://cdn-cms.f-static.net/uploads/4465259/normal_60124656b653e.pdf
    • https://lexabefi.weebly.com/uploads/1/3/1/3/131384613/5083243.pdf
    • https://static.s123-cdn-static.com/uploads/4380869/normal_5ff0bbc7c0cc3.pdf
    • http://disavunasozovod.iblogger.org/hongkong_land_annual_report.pdf
    • https://cdn-cms.f-static.net/uploads/4465136/normal_6022e60950de8.pdf
    • http://trudogoliya.online/97017147256h4oet.pdf
    • https://static.s123-cdn-static.com/uploads/4389101/normal_5ffb7312ab432.pdf
    • https://cdn-cms.f-static.net/uploads/4458849/normal_602a70f8be6e3.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://meferujapepaz.epizy.com/chiari_malformation_type_1_uptodate.pdf
    • https://s3.amazonaws.com/padosumifubobo/42827591651.pdf
    • https://s3.amazonaws.com/vonutavekip/dinoxefijuvukem.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ccab.bin
c8e9cb269041ad8e6020839b6251953ebe4cafa2fa0d401158366944dbb88405
pdf-font-stream PDF embedded font (sfnt) at offset 0xCCAB 4952 bytes
font_01_sfnt_off0000dd9c.bin
75564176d5758500972f82908d7895e82dc3ce7bb3d2ca2325cbe1f20c6d28cd
pdf-font-stream PDF embedded font (sfnt) at offset 0xDD9C 10184 bytes
font_02_sfnt_off0001006b.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176
pdf-font-stream PDF embedded font (sfnt) at offset 0x1006B 4324 bytes