Malicious PDF — malware analysis report

Static analysis result for SHA-256 7e1fe080ec6e8fc7…

MALICIOUS

PDF

79.7 KB Created: 2021-05-06 04:53:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 8e22abcdca8c0da2a4b724ff0573b4f4 SHA-1: 2e10ba8cc058da5dc8697cf372b81be35c4e9edc SHA-256: 7e1fe080ec6e8fc7beca224e9b57b55c6cbe95707bfe8a47f6661c30b892d57b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, which is likely used to redirect users to a phishing or malware download site. The document body, though heavily obfuscated, appears to contain keywords related to product searches, suggesting a lure to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=infinix+note+6+price+in+nigeria+jiji
    • http://vowufijetapiko.sportsontheweb.net/botetijosezuxopozevow.pdf
    • http://rovanenafet.getenjoyment.net/anatomy_and_physiology_an_integrative_approach_download.pdf
    • http://fionainthefield.org/kenmore_elite_washer_not_turning_ono2qdr.pdf
    • https://cdn.sqhk.co/lipetebo/ggjxYI6/ncdoi_ccrc_guide_2018.pdf
    • https://cdn-cms.f-static.net/uploads/4493245/normal_600f3e5a77d51.pdf
    • http://onesmall.space/zivirufuxewujigavitedamu10khx.pdf
    • http://urott-hu.com/posuxapedivu2nb75.pdf
    • https://cdn.sqhk.co/vejanozugova/Chfz3hj/asylum_game_chapter_10_answers.pdf
    • http://xofelivigavas.mywebcommunity.org/skin_cancer_information.pdf
    • http://taforojujutusig.mygamesonline.org/zopusupomozuronudotem.pdf
    • http://vulufinagi.mypressonline.com/equation_of_a_circle_problems_with_solutions.pdf
    • http://fejugutafilevin.scienceontheweb.net/physical_chemistry_formula_sheet.pdf
    • https://cdn-cms.f-static.net/uploads/4369772/normal_605ca5903fc4e.pdf
    • https://cdn.sqhk.co/zovitamojim/dheijh0/petroleum_and_gas_engineering_universities_in_nigeria.pdf
    • https://cdn-cms.f-static.net/uploads/4413361/normal_6010c4bea73d3.pdf
    • http://nowukusox.mypressonline.com/tarizazovipatasixefubegi.pdf
    • http://nipokaxa.getenjoyment.net/has_aot_manga_finished.pdf
    • http://setokanekema.mygamesonline.org/pdfbox_bufferedimage_example.pdf
    • https://cdn-cms.f-static.net/uploads/4465705/normal_604b2a6b000be.pdf
    • https://cdn-cms.f-static.net/uploads/4446029/normal_605948524462c.pdf
    • http://liketime.fun/lincoln_and_guba_criteria_for_qualitative_researchwrz7b.pdf
    • https://cdn.sqhk.co/wogefosa/dhidNid/sanitarium_movie_actress_name.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://niwurekatexo.atwebpages.com/ludamerejelodikixitifuw.pdf
    • https://s3.amazonaws.com/fupanabivote/magudogad.pdf
    • https://s3.amazonaws.com/vofadoloves/menunetimatad.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eabd.bin
00debedbbcafd03526034a3855c860d8fe3b892c232a9f9d98a7c16109944011		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEABD 4996 bytes
font_01_sfnt_off0000fbca.bin
194ff653047bc34c84a053d68f96ed75d4d364f7269f2635016039497ca7772c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFBCA 11544 bytes
font_02_sfnt_off000122ee.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x122EE 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.