Malicious PDF — malware analysis report

Static analysis result for SHA-256 78d32b88e4e12ccc…

MALICIOUS

PDF

115.9 KB Created: 2021-04-15 23:43:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7d00d207bc2225f16258beac46d0427d SHA-1: 41c49020e6cfe4e56324388cf5777e8a7e0efd1c SHA-256: 78d32b88e4e12ccc54fd3bb43d2636ac787e3a8fe0a140416455107e154c8f11
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing an embedded URL that points to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also flagged this PDF with high confidence. The presence of an external URI and the overall detection suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=butler+gender+trouble+1999
    • https://cdn-cms.f-static.net/uploads/4495681/normal_604584f24b32f.pdf
    • https://cdn-cms.f-static.net/uploads/4368748/normal_60304d8e0d643.pdf
    • http://korsabarca.com/dufuxudasolofuleruxe9mth.pdf
    • https://cdn-cms.f-static.net/uploads/4446152/normal_60506871eaa4e.pdf
    • http://netzamka.ru/pdf_nclex_review_questionskfjxz.pdf
    • http://yourlivehelp.com/dagaz84sx8.pdf
    • https://zemijawa.weebly.com/uploads/1/3/1/0/131070152/felivalan-nirakixawa.pdf
    • http://lasns.fun/57382637107un3tq.pdf
    • https://lisogawe.weebly.com/uploads/1/3/5/3/135312855/15cb09.pdf
    • http://streamsweets.com/tidomorixabuzogoberujijidgllxi.pdf
    • http://itravelgr.com/ravivaqyr47.pdf
    • http://fullcreditreport.info/7364237483kn0zp.pdf
    • http://galoomer.online/dugatogomusijwkyw.pdf
    • http://wersita.space/gunther_muller_asaltante_solitario4ozik.pdf
    • http://sberbank.link/jilomomonoi9yre.pdf
    • http://samitap.iblogger.org/tratado_de_direito_penal_bitencourt_vol_3.pdf
    • https://jugomezaxazodo.weebly.com/uploads/1/3/5/9/135994004/3739140.pdf
    • http://sexesex.site/the_lion_the_witch_and_the_wardrobe_chapter_17otfq.pdf
    • http://lazadacostumercenter.com/nakalefebuvikisodusirexavvp935.pdf
    • https://cdn-cms.f-static.net/uploads/4403824/normal_6037cfb17e146.pdf
    • https://kivijakesav.weebly.com/uploads/1/3/2/7/132740669/rogugapipikeju.pdf
    • http://rankingcoach-apps.com/guvowawelebafak59bc.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://wukerakowevomu.epizy.com/ponux.pdf
    • http://nidubopavoxu.rf.gd/91107310245.pdf
    • http://mijitililifi.epizy.com/babogoxojunum.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00018a4e.bin
1c820bf1c9e31bdfb11bc9f42537dccc2f49ccffe9da2407f059b1b1ab189541
pdf-font-stream PDF embedded font (sfnt) at offset 0x18A4E 5000 bytes
font_01_sfnt_off00019b68.bin
96a79cf81d3f5cb752bd74a3594ab6feb9b8a344caf830008607761ad362a105
pdf-font-stream PDF embedded font (sfnt) at offset 0x19B68 11688 bytes