Malicious PDF — malware analysis report

Static analysis result for SHA-256 75cd1d31090e6d16…

MALICIOUS

PDF

75.9 KB Created: 2021-03-23 04:08:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 398673552753be243e8b08a64ca26a95 SHA-1: 81e401dbb3c6d1babcfbcddeb9a49f76304a75f2 SHA-256: 75cd1d31090e6d16f81de83d507c104c7a2c9847c38b9be4ac9a9965a99cff95
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains multiple embedded URLs, one of which is directly referenced by a heuristic as an external URI. The ML classifier and ClamAV detection strongly indicate maliciousness. The document body, though heavily obfuscated, appears to be related to search result content, suggesting a phishing or malware delivery lure. The presence of embedded URLs points to an attempt to redirect the user to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=onkyo+tx-sr606+no+sound
    • http://xrootunited.com/959671588138iyfw.pdf
    • https://cdn-cms.f-static.net/uploads/4476946/normal_605927ae0e1bc.pdf
    • http://instasurprise.online/wahl_clipper_guard_16syg6x.pdf
    • http://wemuwetafivaxe.sportsontheweb.net/linking_words_list_english_german.pdf
    • http://tersq.space/memuje2jiq6.pdf
    • http://service-hire.com/90213602394oujgx.pdf
    • http://retoxen.mypressonline.com/90371630157.pdf
    • http://rejasikega.scienceontheweb.net/vemovakis.pdf
    • http://buylettersonline.com/fair_days_work_for_a_fair_days_pay2a7qo.pdf
    • https://static.s123-cdn-static.com/uploads/4370302/normal_6006a48f2481f.pdf
    • http://fadomofikupiviv.iblogger.org/sulav.pdf
    • http://leqqurint.online/momafilabac8yc2.pdf
    • https://cdn-cms.f-static.net/uploads/4475577/normal_5fe6fb618112f.pdf
    • http://mebelintera.ru/sutuloxevojexapovokal0zcb1.pdf
    • http://lamakexo.scienceontheweb.net/what_is_the_main_theme_of_esperanza_rising.pdf
    • http://flowerport.store/autocad_free_blocks_bedroomgy0yn.pdf
    • http://turosofatilez.iblogger.org/sample_budget_google_sheets.pdf
    • http://kozidozilujivox.getenjoyment.net/pakatan_harapan_manifesto_2020_english.pdf
    • https://static.s123-cdn-static.com/uploads/4403117/normal_5fc847d3550d9.pdf
    • http://gugolufixa.mywebcommunity.org/kasuzudapifesiririn.pdf
    • http://grusha.space/80844171336eybs4.pdf
    • http://xifasiv.getenjoyment.net/rearrange_page_order.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://wulibazosuxib.onlinewebshop.net/advanced_excel_tutorial_2016.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd5e.bin
f791ff7ef2a935996ac9ba3e5c2d21c9416e1a360454fc931e0005dbf5a52200		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDD5E 4884 bytes
font_01_sfnt_off0000ee0e.bin
fb7431ee890ad533b896955f62657fbc1d690d994b45e10807d31d8986bf3cb4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE0E 11228 bytes
font_02_sfnt_off0001145e.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1145E 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.