Malicious PDF — malware analysis report

Static analysis result for SHA-256 8065b81f1ef531d8…

MALICIOUS

PDF

75.1 KB Created: 2021-03-28 23:17:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 367cc6b1a73a272afbdf869cf2894bc0 SHA-1: 773497117e56fb72a79043c9d45cadf232b94482 SHA-256: 8065b81f1ef531d808263b87fc0fb93fc2a07a9543725b70ed3a3e1a6be5e554
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://pelibifir.ru/wix?keyword=non+restricted+cool+math+games', which is likely used to redirect the user to a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to 'cool math games'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=non+restricted+cool+math+games
    • http://davupopebuwiser.sportsontheweb.net/definition_essay_graphic_organizer.pdf
    • http://sowoxapexemex.sportsontheweb.net/high_frequency_response_of_bjt_amplifier.pdf
    • http://delozofize.scienceontheweb.net/warranty_administrator_job_description.pdf
    • https://static.s123-cdn-static.com/uploads/4478946/normal_5fe4d3f8a1d88.pdf
    • https://static.s123-cdn-static.com/uploads/4482206/normal_5ffbaf24e896c.pdf
    • http://lejifip.sportsontheweb.net/k_means_algorithm_in_machine_learning.pdf
    • http://nakotigolajeg.scienceontheweb.net/erosiones_de_cameron.pdf
    • http://xiwesesakuvel.medianewsonline.com/91689938527.pdf
    • http://sunakijabe.sportsontheweb.net/zijez.pdf
    • http://dazavaluk.mygamesonline.org/bilobizozasujaletejuro.pdf
    • http://fakixigulidol.mywebcommunity.org/matter_of_time_lyrics_kem.pdf
    • http://lorozetuwivu.medianewsonline.com/boardman_22_function_bike_computer_instructions.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://wudemexa.myartsonline.com/activex_control_in_vb.pdf
    • http://sakogabutal.onlinewebshop.net/61695311023.pdf
    • https://45ed8376-e832-497f-ab20-0a31924dc5db.filesusr.com/ugd/4b7290_6dc2f3c573a04f17bb070bb2311944d1.pdf?index=true
    • https://30d6ba4c-d201-4e26-8f31-a0e059b28788.filesusr.com/ugd/f9b8bb_52651c5eaa96481baf98ccc6f88988a2.pdf?index=true
    • https://uploads.strikinglycdn.com/files/e51798de-6a60-466b-8241-d2b7c145785c/16101421508.pdf
    • http://gukutimaguvuzum.onlinewebshop.net/what_is_the_most_energy_efficient_electric_heater_on_the_market.pdf
    • https://uploads.strikinglycdn.com/files/30e5d410-187b-47a9-bab7-eb48b055dad7/73395716514.pdf
    • http://jemileti.atwebpages.com/lexus_es_300_hybrid_reviews.pdf
    • https://uploads.strikinglycdn.com/files/15fa505b-bd5c-4e29-8553-b338e89b88ad/58224596111.pdf
    • https://uploads.strikinglycdn.com/files/ff5d3a36-dc69-46b1-9332-f8c57b9ccc92/88270709926.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e7c8.bin
f6e55f492aaac13626e7aec3c61d6f70902a4976cf2f3971a3e6ba09fb0a968e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE7C8 5320 bytes
font_01_sfnt_off0000f9b7.bin
f32c67e7a70d00a0dd12d63944231c01c21b8c90c01dcd25691f0275eb202c5e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9B7 11096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.