Malicious PDF — malware analysis report

Static analysis result for SHA-256 7d770c9588ef4e1f…

MALICIOUS

PDF

77.7 KB Created: 2021-03-07 21:46:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e5a0f918f91dc4f74d6f2d7ffb316986 SHA-1: 1d46dfa41b107501a57eef5ada262a8e436a944d SHA-256: 7d770c9588ef4e1f89be47906604effa96832a41e755e7a7cc5dd9823b4dbd11
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL pointing to a suspicious domain, which is likely used to host a malicious payload or redirect to a phishing site. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, suggesting it might be a generated document used as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9960

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/aws?utm_term=story+of+my+life+funny+quotes
    • https://cdn.sqhk.co/boxepupovemu/iege8gg/yellow_fins_delaware.pdf
    • https://cdn.sqhk.co/tisufupujeli/YzJySjj/dakurevibalix.pdf
    • https://cdn-cms.f-static.net/uploads/4485309/normal_6036f3bc654be.pdf
    • https://cdn.sqhk.co/xegunorasu/toSXhfe/red_roses_lyrics_aj_rafael_chords.pdf
    • https://cdn.sqhk.co/tovipovo/bHhdoha/50994001585.pdf
    • https://cdn.sqhk.co/wuluzajiroz/eniigjh/wekanem.pdf
    • https://static.s123-cdn-static.com/uploads/4452618/normal_5fff7be0cba20.pdf
    • http://retamos.mygamesonline.org/harry_potter_wooden_wands_amazon.pdf
    • http://viniveba.mywebcommunity.org/11288368531.pdf
    • http://jopagozopive.medianewsonline.com/how_to_edit_text_box_in_microsoft_paint.pdf
    • https://cdn-cms.f-static.net/uploads/4375541/normal_6027bedeac53a.pdf
    • https://static.s123-cdn-static.com/uploads/4451940/normal_5fee841154aba.pdf
    • https://static.s123-cdn-static.com/uploads/4464327/normal_5fe5b15a56d42.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/dosipive/bleacher_report_nfl_score_predictions_week_2.pdf
    • https://s3.amazonaws.com/tojabixefova/44453623528.pdf
    • https://uploads.strikinglycdn.com/files/fbeae5d3-6185-458a-b6a1-83748e700484/84549853311.pdf
    • https://uploads.strikinglycdn.com/files/581a5633-c7d6-4a61-be5c-adcfa3902db3/how_to_use_ds4windows.pdf
    • https://uploads.strikinglycdn.com/files/85d5e5ec-8ec5-4d3c-8163-bf86d64cdec6/toximivudugofibeji.pdf
    • https://uploads.strikinglycdn.com/files/3137fc8a-9992-45b6-b18a-7bf66aafd37f/5_themes_of_geography_questions_and_answers.pdf
    • http://bitines.myartsonline.com/fidadimetateletonisizojo.pdf
    • https://uploads.strikinglycdn.com/files/c1d5b450-afea-456c-ac73-8e9d5ef5b8fc/what_is_world_literature_subject.pdf
    • https://s3.amazonaws.com/jikopot/91982646709.pdf
    • https://uploads.strikinglycdn.com/files/ae1875cf-7ed7-4c87-9893-2024e1dfc660/23113530634.pdf
    • http://namepafubi.atwebpages.com/sosiniwebiniluvimejabug.pdf
    • https://uploads.strikinglycdn.com/files/7ea5a0ee-a42b-44c1-93e2-3d880e947186/tumajevunazowajuvamadew.pdf
    • https://s3.amazonaws.com/rimepusox/saxabaxor.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f348.bin
f2cb63dccd6ad5af07d425c0b7dbc6a4af9c359ae141a99b875199af04b618d3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF348 5032 bytes
font_01_sfnt_off00010462.bin
2edc2297278c0b102b2e70d602e722003fa6ab026e86092b4eedafb8d92641a6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10462 11000 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.