Malicious PDF — malware analysis report

Static analysis result for SHA-256 7a07c920f5fc5079…

MALICIOUS

PDF

80.3 KB Created: 2021-04-18 05:21:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 28a1aa7f1fd208b2a5381897aea23c52 SHA-1: 2d1f45d3e6ed3601d88e7cd2e21a2be7ecc3e212 SHA-256: 7a07c920f5fc5079f0a53c9b30542c217ffb17baf540828bdcfc3348cbb0331e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL pointing to a suspicious domain, likely intended to deliver a malicious payload or redirect the user to a phishing site. The document body, though heavily obfuscated, appears to reference a 'Ruger lcp pocket holster', suggesting a lure to entice clicks on the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=ruger+lcp+pocket+holster+with+magazine+pouch
    • http://excellent-spb.ru/yasin_suresi_bilgisayar_hatl3skwk.pdf
    • http://woberenususasop.iblogger.org/algarve_road_map.pdf
    • http://scoretdho.best/pibaguxilomikafofeifnnr.pdf
    • http://mozobadijoba.medianewsonline.com/ntn_needle_roller_bearing_catalogue.pdf
    • http://kudikadip.getenjoyment.net/modopozirudiju.pdf
    • http://pisufixefonof.scienceontheweb.net/breast_cancer_project.pdf
    • http://bluhgang.best/76160169e774p.pdf
    • http://japarof.mywebcommunity.org/leronuworowaramak.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/zupenafud/how_to_setup_samsung_xpress_m2026w_wireless.pdf
    • http://fikelamizogu.myartsonline.com/abstract_class_c_example.pdf
    • http://nanugubodiw.epizy.com/bible_verses_in_tamil_images.pdf
    • http://wixuvixur.rf.gd/mosawilobadajejukobopolup.pdf
    • https://uploads.strikinglycdn.com/files/9f6c8f67-06c7-44de-abe6-0819a769eef6/valibotasitiziweka.pdf
    • http://sogurorirerew.onlinewebshop.net/nomofudamebipup.pdf
    • https://s3.amazonaws.com/saziwijaxodav/harry_potter_book_4_free_audiobook.pdf
    • http://kawerulim.onlinewebshop.net/lumowivadoxigatugadufiruw.pdf
    • https://uploads.strikinglycdn.com/files/4e706c0c-bc45-4b84-ae43-d0b607356665/68819055882.pdf
    • https://uploads.strikinglycdn.com/files/daa51021-eb38-4601-ad04-d46edd050668/place_value_blocks_worksheets_grade_2.pdf
    • http://xejawaji.myartsonline.com/bridal_chorus_free_download.pdf
    • https://s3.amazonaws.com/kibavutibeved/terigejezu.pdf
    • http://delenujafoxa.rf.gd/75573650876.pdf
    • https://uploads.strikinglycdn.com/files/37d42a12-e919-47e6-b3c9-19ac438698b4/latitude_e6410_drivers_wifi.pdf
    • https://uploads.strikinglycdn.com/files/7e82b1e3-629c-4f35-9ff6-e6e86dbdc15b/hegelian_dialectic_prodigy_download.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f00b.bin
fbe1f4cb8d169c31286959b6896ac665818dc623cda0c2ad134980d8484b8aeb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF00B 2988 bytes
font_01_sfnt_off0000faa7.bin
ba7ee4ae4fab73dcec024aeaab345c1eb7a469ce271d46545909f1bf75c19089		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFAA7 5560 bytes
font_02_sfnt_off00010d87.bin
1411915d60f5701f751489da587eba19870d657378b82e27c02aa8a21c02c21d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D87 11024 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.