Malicious PDF — malware analysis report

Static analysis result for SHA-256 78b4e70a8ed19505…

MALICIOUS

PDF

77.6 KB Created: 2021-03-16 03:42:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 64b71b9abadc92db12e05125810f0725 SHA-1: 7a0038bb8c465f8590a536f15e1283ade69925d9 SHA-256: 78b4e70a8ed195056df4010cab2b6cee266feafd8650fa4c282b6160471df72d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The PDF contains an external URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware download site. Although no scripts were explicitly extracted, the PDF format often utilizes embedded JavaScript for malicious actions, hence the inclusion of T1059.007.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=ps+vita+2000+case
    • http://dezlice.ru/dogmatismo_vs_escepticismocfhgy.pdf
    • http://topcreditcheck.info/94309302163obxly.pdf
    • http://cetop.xyz/risozajowogimixo8l3lj.pdf
    • https://cdn-cms.f-static.net/uploads/4460461/normal_601b29bb85f05.pdf
    • https://lurufimuzid.weebly.com/uploads/1/3/4/0/134042860/7085733.pdf
    • https://static.s123-cdn-static.com/uploads/4446260/normal_5fc85c3b3dfb7.pdf
    • https://static.s123-cdn-static.com/uploads/4477916/normal_5ffad04a72e8a.pdf
    • https://cdn.sqhk.co/gunonutib/bTQjage/53128881296.pdf
    • https://cdn.sqhk.co/muzorefu/dnjhdha/just_draw_game_level_15.pdf
    • https://paxowamowutujaf.weebly.com/uploads/1/3/4/3/134322095/1624414.pdf
    • https://cdn.sqhk.co/xovepejegosi/kqWDige/wonunozexujavetamurasafus.pdf
    • http://argo-tourism.com/82327345670vkqvj.pdf
    • https://valiwuvubeke.weebly.com/uploads/1/3/4/6/134694219/waritidilusama-dopujovex-degaxapedaz-sopikigatuzu.pdf
    • https://zasubimivari.weebly.com/uploads/1/3/1/3/131383839/rukebamizotivis.pdf
    • http://fabulouss.space/league_of_legends_adc_positioning_guide8dtk2.pdf
    • https://cdn.sqhk.co/kuruwoke/jcggxhg/flip_folder_and_lyre_for_trumpet.pdf
    • https://cdn-cms.f-static.net/uploads/4382420/normal_602e470a48279.pdf
    • https://fitijozis.weebly.com/uploads/1/3/4/3/134372299/4d00892d4.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/07cd13e4-2ae7-4212-a03f-f174f9071828/plant_dichotomous_key_worksheet_answers.pdf
    • https://d17f4099-ecc1-42b1-9c73-51521793457c.filesusr.com/ugd/4a2613_bd49fdc1d79141c4b020b3155f085cba.pdf?index=true
    • https://9042e326-c85f-44e6-b9b6-0c206471fdba.filesusr.com/ugd/0d2fda_1decacbf75924dc582162a876b14cdc4.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b947c6af-0916-4174-8472-cb874ab9e6d8/mononajodutevilix.pdf
    • https://d3df31c7-72fe-42b1-a92e-0723e8ed7a16.filesusr.com/ugd/5bf82b_defa5c5c55ec4e5d93fa317ca36e6f88.pdf?index=true
    • https://uploads.strikinglycdn.com/files/1d76f693-596f-499e-b5b9-9be3ab390378/kabomigovo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f2f3.bin
1d924e12e6fa51c415da2241dda0da1cb94b065f211506c9eacbf22b18e84249		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF2F3 5000 bytes
font_01_sfnt_off00010412.bin
196f6dc0e327f159d0b7d90a054aad5a57de081c5f27d51d953ec1fa538c31a3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10412 10764 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.