Malicious PDF — malware analysis report

Static analysis result for SHA-256 77aeb27579e404e4…

MALICIOUS

PDF

124.8 KB Created: 2021-03-21 01:24:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7ccecafdbe9568b3cde2a2883d386d72 SHA-1: 1c4216e6bdf5f7f87fa6e36c42792bcef3c1abb6 SHA-256: 77aeb27579e404e4f5e989df97e87a8b74650a1664ae4bbf76679604c281b650
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf and includes a URL that mimics a search query for a PDF document. This URL, along with numerous other embedded URLs, likely serves as a lure to a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9761

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=agile+manifesto+values+and+principles+pdf
    • http://bumalutaf.iblogger.org/56762433790.pdf
    • https://binikefesomeb.weebly.com/uploads/1/3/5/3/135386190/4781043.pdf
    • http://parkji5x.xyz/what_is_a_split_sentence_in_grammaryibpv.pdf
    • https://cdn.sqhk.co/zasokolof/iib3ohb/buzupupanikurilug.pdf
    • https://cdn.sqhk.co/gapebeve/gj3gjhe/karumukuwenuxonarol.pdf
    • http://help-ruleviolation.com/best_photo_editor_free_android58u09.pdf
    • https://dofigova.weebly.com/uploads/1/3/0/8/130813881/c92f919a54e4e.pdf
    • http://imm-shoes2.club/best_android_game_engine_3dp7ma0.pdf
    • http://lidagejelotodu.22web.org/iwcf_level_1_questions_and_answers.pdf
    • https://jazawimap.weebly.com/uploads/1/3/5/3/135346256/jokonuzowoxororud.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • http://www.opentle.org
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/df763275-9434-4107-bab6-21991d30a7ea/jekadov.pdf
    • https://uploads.strikinglycdn.com/files/dd4977e8-d5ff-436a-868b-700cee92e727/88210518532.pdf
    • http://pujusojup.epizy.com/dasam.pdf
    • https://uploads.strikinglycdn.com/files/d9100465-6870-4a8d-8300-9255f088c7fc/what_does_chi_hao_mean_in_chinese.pdf
    • http://zezatutafut.epizy.com/how_much_is_ace_personal_trainer_exam.pdf
    • https://uploads.strikinglycdn.com/files/4ac79a7b-0feb-4633-9bb5-eaa728711298/computer_accessories_store_nearby.pdf
    • http://tekitizufexuwo.rf.gd/jared_diamond_the_world_until_yesterday_summary.pdf
    • http://nakuwoxadi.epizy.com/dusigaluneletadimuza.pdf
    • http://xewowibaxe.rf.gd/ghana_banking_act_2020.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL
    • http://www.gnu.org/licenses/lgpl.htmlRegularDanhHong
    • http://www.geocities.com/dnhhng
    • http://sinhala.sourceforge.net/
    • http://sinhala.cvs.sourceforge.net/viewvc/*checkout*/sinhala/sinhala/fonts/CREDITS
    • http://www.gnu.org/licenses/gpl-2.0.html
    • http://www.gnu.org/licenses/gpl.html
    • http://scripts.sil.org

Extracted artifacts 14

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_011_off00018cf8.bin
a0961b42c5318ff6115bd86d58da556a695fb66bbea1a70eb3ab397eb474bd09		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x18CF8 18200 bytes
font_00_sfnt_off0000eb15.bin
8dd08da0b50e983952fe00ff37b6d1e9ad3cc266fe914d8be907ccb254108774		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB15 5684 bytes
font_01_sfnt_off0000fee9.bin
ab84ea96760e308c82602bf846e1df6c6b4a4d74ee1733a19a58cc9c8ded81f4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFEE9 5408 bytes
font_02_sfnt_off00011137.bin
c206ac4eca120f096112d408dff6b33a2f721090936d80486df636e1cd240fde		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11137 2656 bytes
font_03_sfnt_off00011c37.bin
8de763cc392d555d6555ce28e49a7801ce7361977d5c0c1f0cca23967a7df2d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11C37 4544 bytes
font_04_sfnt_off00012a41.bin
7f3a1ef136f36ba68bc36e5bcd31de243dce7f4b60e01c4bc40f508baeb48ca0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12A41 2604 bytes
font_05_sfnt_off0001351c.bin
cca5298ad2e89ab0d41cc63a8205340d9321530172a8d5dda1c28d17fa56adaa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1351C 3840 bytes
font_06_sfnt_off00014329.bin
e66bd646ff29f48b94a898642357a1d5295b77faffa0bd70eb77acb4aebc9a97		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14329 2108 bytes
font_07_sfnt_off00014cf5.bin
eca62b72654736461a635ba366d09d794777fd95c58152d2b251becdfce657e0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14CF5 6640 bytes
font_08_sfnt_off00015e93.bin
21be377bfaf18ea18ca740d77183eabccf027545e45f7c4e9a4ca18c8cea06dd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15E93 15680 bytes
font_10_sfnt_off0001a9bd.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A9BD 4324 bytes
font_11_sfnt_off0001b7c7.bin
ddc549338fcc81ec40a7b4a692679fe8edf12a605c6e06bbb20a40a2c05f504b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1B7C7 3848 bytes
font_12_sfnt_off0001c69e.bin
de8bdd4d27b85fe5e1825bdf30309bd3fb6e4ce3935015bd39a0f1293a5d4eff		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1C69E 4356 bytes
font_13_sfnt_off0001d50e.bin
c4869f4910101e9de114603d80c87e7465cc14a3edf423f39a6ef78b10429b6f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1D50E 2608 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.