Malicious PDF — malware analysis report

Static analysis result for SHA-256 7de4b1860018934b…

MALICIOUS

PDF

86.0 KB Created: 2021-03-24 12:12:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3c9c422a97f8c2ca6af47196e3c793ae SHA-1: 2d968f2cd0e0427ded29f484246171b664acdefb SHA-256: 7de4b1860018934b82f11d5dbdcefd68c4253348190ab617ee7eedb38d96dd12
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. The ML classifier and ClamAV detection strongly indicate malicious intent. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest it's designed to redirect users to malicious content, potentially a phishing page or a download site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=c+programming+language+book+reddit
    • https://cdn-cms.f-static.net/uploads/4426687/normal_603483ffe5bf8.pdf
    • http://finuxezanasa.mygamesonline.org/smc_hydraulic_cylinder_catalog.pdf
    • http://wotukujis.sportsontheweb.net/leonard_cohen_biography.pdf
    • https://static.s123-cdn-static.com/uploads/4489414/normal_5fcf5e872af04.pdf
    • http://bewizasosu.sportsontheweb.net/what_order_should_i_read_the_halo_books_in.pdf
    • https://cdn-cms.f-static.net/uploads/4380692/normal_6017200abc66a.pdf
    • https://turarizamagux.weebly.com/uploads/1/3/1/4/131453837/reluliw_dunusuru.pdf
    • http://rejorevubirobu.sportsontheweb.net/audix_f12.pdf
    • https://cdn.sqhk.co/somujatiza/jjhgeok/star_jolt_arcade_challenges.pdf
    • https://widosutolitidaf.weebly.com/uploads/1/3/4/8/134847614/1983110.pdf
    • https://cdn.sqhk.co/dogojaseziwo/jjijhdO/modals_and_auxiliary_verbs_in_english.pdf
    • http://fiwetud.scienceontheweb.net/biogeography_download.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/1b2d1d61-c1ac-43eb-9b88-61b882b64779/how_much_does_a_log_dining_table_sell_for_animal_crossing.pdf
    • https://uploads.strikinglycdn.com/files/b29a459d-6aef-46f8-908f-56dd81b9e514/lenovo_thinkcentre_m82_drivers_for_windows_7_64_bit_download.pdf
    • https://uploads.strikinglycdn.com/files/044d1da3-1afd-44a4-a10f-cb3a6ca855e4/89485057653.pdf
    • https://de99934f-f465-4d69-af5e-14f317c0a7c6.filesusr.com/ugd/4fea5c_78f5393bebff4ee4b6b0aea1358d0290.pdf?index=true
    • https://baad1762-ad72-434c-be9a-9de7d8068d01.filesusr.com/ugd/61395f_5df52b25cdbf4e0182ced1514d180e0e.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3fa1a1ab-a25f-4664-9cf2-f3d8c9feec8e/18291027072.pdf
    • https://ccd4a2e6-63e2-4dcb-a02e-1ae1253dabcc.filesusr.com/ugd/059ff1_d78d2437763344719e006251a531596e.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000101dc.bin
5e33ff2059876689dafcede8137f51f87347cd73c272ca8475975675e542d845		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101DC 5212 bytes
font_01_sfnt_off00011377.bin
e8c3255a7f98173759eb5a13eae18e10342bdcdc7020736dab0ce4d3fcc26206		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11377 12004 bytes
font_02_sfnt_off00013c9e.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13C9E 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.