Malicious PDF — malware analysis report

Static analysis result for SHA-256 78e2bfc2f8695daf…

MALICIOUS

PDF

77.1 KB Created: 2021-04-02 13:55:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fb14f392175aa24a8b45507d32c4ccf3 SHA-1: 750a11199365c2412c3c558a0ca7aebd38d22a38 SHA-256: 78e2bfc2f8695daf1d399053e2919aa8b68fc946a393cb10ad54c3a80e83a53f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing an embedded URI that points to a suspicious domain, identified as malicious by ML classifiers and ClamAV. The document body, though heavily obfuscated, contains text that appears to be a lure related to a book title, suggesting a phishing or social engineering attempt to direct the user to the malicious URL. No scripts were extracted, but the presence of the malicious URI is a strong indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/award?keyword=de+cero+a+uno+filetype+pdf
    • https://cdn-cms.f-static.net/uploads/4403952/normal_600ba97156603.pdf
    • https://static.s123-cdn-static.com/uploads/4452389/normal_6005008a4a0b0.pdf
    • https://rasogumelix.weebly.com/uploads/1/3/5/4/135400304/7347855.pdf
    • https://cdn-cms.f-static.net/uploads/4489839/normal_6033bb194f3cb.pdf
    • https://xutonipojoneri.weebly.com/uploads/1/3/4/6/134667901/tixibadipubabinexug.pdf
    • http://bbflowers.net/933301417307veog.pdf
    • https://static.s123-cdn-static.com/uploads/4404133/normal_5ff4d83c66eac.pdf
    • https://fuvenaxumegiga.weebly.com/uploads/1/3/3/9/133999500/e8777691518614f.pdf
    • http://retys.space/4022274343iwccv.pdf
    • http://keepmaxi.space/42391299098k4pjy.pdf
    • https://nebofubegifeso.weebly.com/uploads/1/3/1/4/131437549/punudaga_vokoxirozop_mubomuzokekid_zijegi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/badodemebo/bitsat_mock_test_2018.pdf
    • https://s3.amazonaws.com/dewutexorob/send_email_from_template_outlook_2013.pdf
    • https://s3.amazonaws.com/salosibejodod/subefowa.pdf
    • https://s3.amazonaws.com/megujobemegor/kuzigotaxub.pdf
    • https://uploads.strikinglycdn.com/files/43ee5a5f-fdd3-47b2-a2f5-c7aa91257c31/fivuxuwaduxeloma.pdf
    • https://uploads.strikinglycdn.com/files/f06ac142-8d51-4a20-ad8d-26ad917cd65c/fogaruzuzijixunotavofama.pdf
    • https://s3.amazonaws.com/tixeligufokup/night_blur_background_hd.pdf
    • https://s3.amazonaws.com/veraxawewib/oreck_xl_parts_list.pdf
    • https://uploads.strikinglycdn.com/files/a9b0f316-ffdc-4589-8241-ec1026458bd3/scooter_flat_tire_repair_near_me.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e15e.bin
e0665340f93925da069dc97846ba1fa3f28732ab7fe161e3984d77d849358c30		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE15E 4952 bytes
font_01_sfnt_off0000f249.bin
a7ad57af74acbc78c53591020b779a34b455c7f0ee334f901f31ce1004214083		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF249 11940 bytes
font_02_sfnt_off000118fa.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x118FA 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.