Malicious PDF — malware analysis report

Static analysis result for SHA-256 7f9d9146ab45a519…

MALICIOUS

PDF

78.2 KB Created: 2021-04-09 09:57:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 0e6fa577ff5ed3a5e844c9c39c5e8e58 SHA-1: d3fe967f5cccf74d767e858b3dee653498dc69dd SHA-256: 7f9d9146ab45a519bc6fe39e0044f28f710eb0730aa075b25aa69bbfb1aaacf0
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'midufefew.ru', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to financial advice, a common tactic for phishing campaigns.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/strik?utm_term=how+to+budget+money+for+beginners PDF link annotation
    • http://tokio-2020.fun/wosomop93f81.pdfIn PDF document text
    • http://rusakadovub.sportsontheweb.net/65806056126.pdfIn PDF document text
    • http://gigezesuzobe.getenjoyment.net/summary_of_the_poem_the_road_not_taken.pdfIn PDF document text
    • http://kulinar2020.site/born_free_book_freeqmnig.pdfIn PDF document text
    • http://static-get.top/geometry_proving_congruent_trianglesk7odc.pdfIn PDF document text
    • http://letabumo.getenjoyment.net/el_federalismo_en_mxico.pdfIn PDF document text
    • http://zubiki.top/2580886941bj636.pdfIn PDF document text
    • http://zotoxilob.getenjoyment.net/kepimogafiwogaruf.pdfIn PDF document text
    • http://ninefukesat.iblogger.org/who_is_the_raven_in_animal_farm.pdfIn PDF document text
    • http://appletopshop.ru/tamil_advertisement_mp4_videohqgfy.pdfIn PDF document text
    • http://zerulowomuv.22web.org/deduxagikotirube.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/julaxel/free_john_deere_lawn_tractor_repair_manuals.pdfIn PDF document text
    • https://e1318bff-d970-45e2-bcea-45481503a18b.filesusr.com/ugd/75a96d_c19962974ddb4e34910585dfad76f3b6.pdf?index=trueIn PDF document text
    • http://xasibaj.epizy.com/27270387.pdfIn PDF document text
    • https://56db2a4d-09ce-4ff6-a558-abb1d6727cd4.filesusr.com/ugd/003b86_a237ade557484f9b9c229864f61d7527.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wozowuledij/58794885948.pdfIn PDF document text
    • https://95a83a18-022f-4aa5-9dc2-588eac4c5c4a.filesusr.com/ugd/ccb6ab_433342f7a13b4b4db797b6cc095b9fd4.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vebisop/helm_chart_template_if_condition.pdfIn PDF document text
    • https://160e4e15-e27a-4ef2-9b26-f67fc0969a86.filesusr.com/ugd/cbdbb6_1c883aa9724e4168aedfb15c046f9df1.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/lodazojamuva/facebook_videos_on_chrome_browser.pdfIn PDF document text
    • https://s3.amazonaws.com/jivuxo/checks_and_balances_worksheet_answers.pdfIn PDF document text
    • https://006b50d4-ad2a-4261-8279-34542eb0d7b0.filesusr.com/ugd/a640e9_c583edfb373a4a8091abe81d6ab6b2b1.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wozoxub/free_piano_sheet_music_hallelujah_chorus.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f177.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF177 5280 bytes
SHA-256: e90b83e5bf773d0ffcced9b980042f70f746df62d440d7736f80a83eff3b452b
font_01_sfnt_off00010371.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10371 11044 bytes
SHA-256: 172d9cc9f3cf93f3f771b509cc5406762fe273714cb5b645eaf9ee887c5625d4

Open this report in the interactive analyzer, or submit your own file for analysis.