Malicious PDF — malware analysis report

Static analysis result for SHA-256 7be9cb02712788af…

MALICIOUS

PDF

86.4 KB Created: 2021-04-06 01:08:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 64b91ac60a22a36b688eaa83c695360d SHA-1: 610a866a69fad5f9cdccf60a913a699a842efff6 SHA-256: 7be9cb02712788af91d982ae0995e05c07f266b8448d10663968f6940a6a8d64
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely intended to host a malicious payload or phishing page. The document body, though heavily obfuscated, appears to be a lure related to a book search, aiming to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/wix?keyword=marissa+meyer+scarlet+pdf+indir
    • https://static.s123-cdn-static.com/uploads/4454040/normal_5fe1074d796cd.pdf
    • https://static.s123-cdn-static.com/uploads/4449998/normal_60053ba554f1b.pdf
    • https://lawagupavuraxap.weebly.com/uploads/1/3/4/6/134616311/wekuvo.pdf
    • http://axecheat9.xyz/xopexusisg3hy.pdf
    • https://cdn-cms.f-static.net/uploads/4498986/normal_5fe869eccc09b.pdf
    • https://nufofosag.weebly.com/uploads/1/3/4/6/134607331/lofamarenedisixip.pdf
    • https://domilejoxu.weebly.com/uploads/1/3/4/5/134529458/dowaw.pdf
    • http://telgrm.site/concept_sheet_architecture_pinterestj3luw.pdf
    • http://ndfnasg.xyz/xigazonujikidenoluubo3w.pdf
    • http://cookwellbakewell.com/20441144237efw31.pdf
    • https://cdn.sqhk.co/tebefaravuz/jnnpURS/professional_sketch_master_template.pdf
    • https://guvolobojifo.weebly.com/uploads/1/3/4/7/134733869/1518252.pdf
    • http://itslm.fun/44790035770ykat6.pdf
    • https://cdn.sqhk.co/kufiremikaf/eQhRiio/battle_tank_1990_rom.pdf
    • https://devubavoxonor.weebly.com/uploads/1/3/2/7/132741482/aa205697051a.pdf
    • https://jurivulanikep.weebly.com/uploads/1/3/4/5/134525456/zawobizizesun-xopumiruvisij-fuzovepobo-lizurabafa.pdf
    • https://cdn-cms.f-static.net/uploads/4408873/normal_5fd2a8c2b8273.pdf
    • https://cdn.sqhk.co/juzosugun/jlhjhdL/temple_run_2_giant_snake.pdf
    • https://mirovufi.weebly.com/uploads/1/3/5/9/135958785/9e761d65e15.pdf
    • https://cdn.sqhk.co/wasusoguba/hNRiiwR/59476803781.pdf
    • http://rkconstructionsucks.com/graphing_quadratic_functions_a_3-_2_answers3is8i.pdf
    • https://cdn.sqhk.co/tixunadegu/3r7zBge/daily_driver_sf_menu.pdf
    • http://katalog-siberian-force.online/113035959049itx2.pdf
    • http://sluzhba1.net/bollinger_bands_formula4tm96.pdf
    • https://cdn-cms.f-static.net/uploads/4366408/normal_6037b96ae97ad.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010f17.bin
f363b39cb5006b3d5a3265f0d1a11e3be37f82ea7e714f79f2f01009bb47939d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10F17 5408 bytes
font_01_sfnt_off0001217a.bin
6730cb4a329593d16c22560bb2db5a6372d2103e6d9d97da854a2c95bd47f6e6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1217A 13368 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.