Malicious PDF — malware analysis report

Static analysis result for SHA-256 80088e75dfc993e5…

MALICIOUS

PDF

83.6 KB Created: 2021-03-27 23:53:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 28e2e2a7181f376d711d9cb19e033340 SHA-1: d6e07dd39cf1b0d787dcc8936b38a169ae9b39ff SHA-256: 80088e75dfc993e5d792f0d251ad15ba4644db0ca3de55b480493aab862ece30
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The document body, though heavily obfuscated, contains text related to 'Living air xl15 replacement parts', suggesting a lure for phishing or a scam. The presence of multiple external URLs, including one pointing to 'dafemum.ru', indicates the document is designed to redirect users to potentially harmful content or download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=living+air+xl15+replacement+parts
    • http://nunobuzipame.medianewsonline.com/38317789702.pdf
    • https://cdn.sqhk.co/veletafi/gGjfKqQ/color_code_chart_asian_paints.pdf
    • https://cdn-cms.f-static.net/uploads/4491450/normal_604f37b5d692f.pdf
    • http://pogawubujogeje.mypressonline.com/gigabyte_easytune_windows_10_64_bit.pdf
    • https://cdn-cms.f-static.net/uploads/4426832/normal_605d3e6697001.pdf
    • https://cdn.sqhk.co/tivanosox/ges5F1h/the_wolfman_full_movie_watch_online.pdf
    • http://bumawusuka.mypressonline.com/kotijofadozunadini.pdf
    • http://wabiferofuvud.mygamesonline.org/bmat_practice_test.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://rodedewezijore.atwebpages.com/dantes_divine_comedy_summary_sparknotes.pdf
    • http://jalijoruki.atwebpages.com/13531665240.pdf
    • http://zubidoziradep.rf.gd/askep_bayi_bblr.pdf
    • http://tufomatewivade.rf.gd/classroom_rules_printable.pdf
    • https://uploads.strikinglycdn.com/files/553143e4-9506-43cd-82b6-7462c54c06cf/5473261597.pdf
    • https://uploads.strikinglycdn.com/files/69956d0f-bf51-4964-b95c-d8f456ba2bbb/43598964641.pdf
    • http://surafupomef.epizy.com/kuluroxuno.pdf
    • http://saxodanokijaj.atwebpages.com/blue_caprice_victor_morosco.pdf
    • http://pelubameta.epizy.com/ionic_foot_bath_color_guide.pdf
    • https://uploads.strikinglycdn.com/files/9b358d5a-7676-4c41-ad92-891d56f585fc/the_boys_comic_book.pdf
    • http://popofisofol.myartsonline.com/72204616537.pdf
    • http://rogofideb.onlinewebshop.net/webasto_standheizung_bedienungsanleitung_vorwahluhr_1530.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f39f.bin
f0535fea16c6e48e381fca7cdf2cce630e2fd5462e03ea461610549030e53564		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF39F 5500 bytes
font_01_sfnt_off00010659.bin
b1c2df2cc99d8797bfefe003a5870b2e25927e1398bc9da562c4774b676c45d6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10659 10940 bytes
font_02_sfnt_off00012bd5.bin
173e74cb656ce8cf62e9dba6189377201a248cf59bd5f118deeb5932e9a17b3a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12BD5 16132 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.