Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b09e407a1474e30…

MALICIOUS

PDF

72.0 KB Created: 2021-04-22 19:51:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1992dfa9eaf3aae10463632668c7aa84 SHA-1: 2081b8b547c80f2ff441c1b8c7bc05d29d1432a2 SHA-256: 7b09e407a1474e30938d4b8c7ef0f460a82e851115b1e08917a0ba469135358b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI that directs users to a suspicious domain, likely to deliver a malicious payload or phish for credentials. The document body, though heavily obfuscated, appears to contain metadata related to its creation, including the wkhtmltopdf tool, and a search query that serves as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=how+to+program+cuisinart+burr+grind+and+brew
    • https://cdn-cms.f-static.net/uploads/4450519/normal_605d166b184c0.pdf
    • http://redirerer.medianewsonline.com/antrenmanlarla_matematik_1_cevaplar.pdf
    • http://forovasax.medianewsonline.com/kenmore_elite_he4_dryer_reviews.pdf
    • http://gutibefatidag.medianewsonline.com/pasezoz.pdf
    • http://muwenigijevas.22web.org/capsule_chapter.pdf
    • http://sozaxesugoj.mywebcommunity.org/math_quiz_bee_questions_and_answers_for_grade_8.pdf
    • https://static.s123-cdn-static.com/uploads/4413223/normal_5fec06ce01482.pdf
    • http://pawosevisipe.iblogger.org/68607858116.pdf
    • https://static.s123-cdn-static.com/uploads/4453563/normal_5fc6b687ae6f8.pdf
    • http://jiwapadenejeza.getenjoyment.net/asus_xonar_dgx_uni_drivers.pdf
    • http://semasinizitowo.medianewsonline.com/21412133354.pdf
    • http://fomoregekamikat.mypressonline.com/2020_questions_about_me.pdf
    • https://static.s123-cdn-static.com/uploads/4455669/normal_6000a4072cdae.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://viwukekev.rf.gd/behold_our_god_lyrics.pdf
    • http://rotufixijisadi.onlinewebshop.net/brazilian_jiu_jitsu_for_beginners.pdf
    • https://uploads.strikinglycdn.com/files/24953403-e6f7-461d-9146-a05747434f34/what_is_rawls_social_justice_theory.pdf
    • https://5090c2af-253d-40c3-bfb7-942fc6db26b0.filesusr.com/ugd/0511f5_8419b1021ecf4f7fb2359deb0175e990.pdf?index=true
    • http://jigosip.epizy.com/metal_cutting_and_machine_tools_lecture_notes.pdf
    • https://ad843f61-c544-48d7-8cfb-3c048b9edb46.filesusr.com/ugd/0dd9ed_229e65e3c894455185630e4ebc260aa9.pdf?index=true
    • http://ledaruwevegoxu.onlinewebshop.net/alter_ego_2_cahier_d_activits.pdf
    • https://uploads.strikinglycdn.com/files/07108fbb-7af9-4231-970c-0d97f8244ba8/motorola_sb6141_turn_off_lights.pdf
    • http://runesufosufej.rf.gd/82661458507.pdf
    • https://uploads.strikinglycdn.com/files/3b454c25-b5bc-433e-b75e-b5c23ef14931/15587090298.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d96c.bin
3f36a5c7afccd00dfdea1ebed7d21e5350355d100d6d91925b856c5a5c415b87		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD96C 5556 bytes
font_01_sfnt_off0000ec41.bin
53ae6e2ecf7b3f7cd76813b50f085240f29bbba88b502f6dfdcd213bc0d86a88		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEC41 11240 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.