Malicious PDF — malware analysis report

Static analysis result for SHA-256 780b5fb42cc75cbf…

MALICIOUS

PDF

73.0 KB Created: 2021-03-29 16:49:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b51a99b921dfec9fc0108bfc23bd57a5 SHA-1: 7fe74153853560bac65204f63480b8ca5186655f SHA-256: 780b5fb42cc75cbf2141ccd6059e603867032728574c205caf7fef513954ef49
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains an embedded URI pointing to a URL that appears to be a search query for a manual, likely a lure. While no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site, potentially for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=manual+for+briggs+and+stratton+550+series
    • https://cdn-cms.f-static.net/uploads/4471475/normal_5fd808882cb4f.pdf
    • http://firavowinoza.iblogger.org/how_to_take_screenshot_in_mac_mini_using_windows_keyboard.pdf
    • http://znohist.site/90466706841h28k.pdf
    • https://static.s123-cdn-static.com/uploads/4481069/normal_5fe3adc47928d.pdf
    • https://cdn-cms.f-static.net/uploads/4379859/normal_6049428bd388e.pdf
    • http://lnstagram-helping.live/sesunimiwuzopejotugino1rb42.pdf
    • https://static.s123-cdn-static.com/uploads/4383327/normal_5fe2b23eb8861.pdf
    • http://yyyyyyhhhhh.space/364715662737i0hs.pdf
    • http://apkweb.net/ryobi_40v_chainsaw26v26.pdf
    • http://criticcxck.space/clasificacion_y_definicion_de_las_cuentas_de_balance_y_resultadosd54eg.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://zizaminejif.rf.gd/57659876158.pdf
    • https://uploads.strikinglycdn.com/files/b398f149-2c1d-4429-bdfb-c6560210f24f/riwuxeromujubowafefime.pdf
    • https://c44f4a6d-8922-4093-a150-c9e6b6244fdd.filesusr.com/ugd/b371d9_242db6ea24754b3b8b8d1d2c0473fa4c.pdf?index=true
    • https://uploads.strikinglycdn.com/files/0237e688-9445-4bb1-8049-1072e73b5055/mulisibawimibejube.pdf
    • https://153f2bed-3501-4ec5-9468-ed1987511f6d.filesusr.com/ugd/f67134_167ce09a09bc4131ad837c954c34284d.pdf?index=true
    • https://ad9e3d1f-bb22-46ca-892e-b6aa3325a756.filesusr.com/ugd/837d34_ea6a303832ef457981461f494ffdd66a.pdf?index=true
    • https://5f98d79b-b704-4ecc-a618-200e52db7f79.filesusr.com/ugd/d1a5b7_a8e8058f6c6b4183ae9b6ecd8bf711fe.pdf?index=true
    • http://jefebewo.epizy.com/adobe_illustrator_corel_draw.pdf
    • https://ba10d46a-d7c1-43af-8542-f1a50f31aa8a.filesusr.com/ugd/4dded2_a5ab96c512244d7bbc28dd02d0843ede.pdf?index=true
    • https://uploads.strikinglycdn.com/files/22a4da90-1b11-437f-afc6-dbd56d4d631f/58991549848.pdf
    • https://aa4a64a1-c69a-4176-9ab9-82648dcabbba.filesusr.com/ugd/70701b_0d46abb8979846ba9cb9fafaa8fff627.pdf?index=true
    • https://488c2ff9-9ff4-499e-8f11-525115e20b22.filesusr.com/ugd/8aba0c_f949a1aa173d43d6a34e5fede6e0502e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/6b1cd05c-d630-479e-9b13-3f0170de9d83/lebimeximifemapit.pdf
    • https://uploads.strikinglycdn.com/files/19cf8514-53b0-47ba-9259-a16f5deb7d61/85348078068.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d13c.bin
c8fc2aa697461cb4d97425dd41a6e095cf257fcecd93f173a3cba99253edf1f4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD13C 5368 bytes
font_01_sfnt_off0000e38a.bin
e16b0555d7aa7e09aaf302dfb42f77a8ec345618f0fbe3e24457a501f3b30a3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE38A 10652 bytes
font_02_sfnt_off000107fa.bin
05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176		 pdf-font-stream PDF embedded font (sfnt) at offset 0x107FA 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.