Malicious PDF — malware analysis report

Static analysis result for SHA-256 7f376fd6e4c5a75a…

MALICIOUS

PDF

86.7 KB Created: 2021-05-23 15:36:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7172a377a6a7f7c8fd56a645543d222e SHA-1: e2c20a409a1a5c14d208e9fd9cb7273ec134d797 SHA-256: 7f376fd6e4c5a75abd62f8ee1edcd524030a32fb0e7b6f1e9d7e291507902ab8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that mimics a search result for a movie, aiming to trick the user into clicking it. This URL leads to a suspicious domain, and the file was flagged by ClamAV as a phishing trojan. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/strik?utm_term=the+usual+suspects+movie+online+with+english+subtitles
    • https://cdn-cms.f-static.net/uploads/4402963/normal_6032f4b2ee10a.pdf
    • https://static.s123-cdn-static.com/uploads/4464851/normal_5ffe4ea97a374.pdf
    • https://cdn-cms.f-static.net/uploads/4453888/normal_6057942c92485.pdf
    • https://static.s123-cdn-static.com/uploads/4383475/normal_5ffdb24ca9d7c.pdf
    • https://cdn-cms.f-static.net/uploads/4367905/normal_6019086cc07af.pdf
    • https://cdn-cms.f-static.net/uploads/4366015/normal_601dd10abc8af.pdf
    • https://static.s123-cdn-static.com/uploads/4488804/normal_5fcf3bab5dcbb.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/joterige/35512081007.pdf
    • https://s3.amazonaws.com/levovod/hp_update_software_utility_windows_10.pdf
    • https://s3.amazonaws.com/xajowu/small_essay_on_importance_of_value_education.pdf
    • https://s3.amazonaws.com/sejakopa/gejixiwagukizuvedubifo.pdf
    • https://uploads.strikinglycdn.com/files/1d0a71b6-3f0e-48c1-ad6b-246e1cef372b/97141799860.pdf
    • https://s3.amazonaws.com/zibenoroduzuw/how_long_is_the_war_arc_in_naruto.pdf
    • https://s3.amazonaws.com/zifilobesumafi/17267266228.pdf
    • https://s3.amazonaws.com/salosibejodod/89599367859.pdf
    • https://s3.amazonaws.com/fofeguj/zidukulurazikagitawi.pdf
    • https://s3.amazonaws.com/xufujofaleki/82527381974.pdf
    • https://uploads.strikinglycdn.com/files/7fc3759c-5771-4e72-880e-6c4685d5ec6b/5320909644.pdf
    • https://s3.amazonaws.com/dujepav/atif_aslam_coke_studio_songs.pdf
    • https://uploads.strikinglycdn.com/files/502af238-89b3-4a28-b42b-87b9e76924d7/samsung_galaxy_note_20_ultra_price_philippines_2020.pdf
    • https://s3.amazonaws.com/jikopot/vijay_tv_advertisement_video.pdf
    • https://s3.amazonaws.com/nisiwanolom/twilight_new_moon_moviescounter.pdf
    • https://s3.amazonaws.com/muwomapotumugi/car_race_movie_in_tamil.pdf
    • https://uploads.strikinglycdn.com/files/45bf251f-ed27-459a-9700-e6521ffaa91c/combining_like_terms_with_negative_coefficients__distribution.pdf
    • https://s3.amazonaws.com/paxivogedewilu/lozanevusowos.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f576.bin
d3390ea82dfc320a475db7533a1f1c0504040f70493640b18a7ed389c21098ae		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF576 5492 bytes
font_01_sfnt_off0001081a.bin
2d1f6d883238883f5226d4652211c21f1b5a085d42e7555ee41389f3753aa07f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1081A 14496 bytes
font_02_sfnt_off000135fb.bin
73f6f760a67782f27700c3ed047511a210a1e3765a9cc4fd416c63ff6a2522af		 pdf-font-stream PDF embedded font (sfnt) at offset 0x135FB 16060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.