Malicious PDF — malware analysis report

Static analysis result for SHA-256 82139d329aed4ddf…

MALICIOUS

PDF

94.8 KB Created: 2021-06-01 02:49:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: af36181abf4c62bd7387cca387def11e SHA-1: 5b45591913cdc3734e96619247cab8b1de0c674f SHA-256: 82139d329aed4ddf8afaf13e8260d20515e48ac0786b232984b34bc7714f391d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that leads to a phishing site, as indicated by the ML classifier and ClamAV detection. The document body, though heavily obfuscated, suggests a lure related to child stuttering, aiming to trick users into visiting the malicious URL. No scripts were extracted, but the presence of an external URI and the overall detection suggest a phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9889

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://irlanc.ru/pbw?utm_term=how+can+i+help+my+child+with+stuttering+at+home
    • https://cdn-cms.f-static.net/uploads/4408184/normal_604f5d67ee9e7.pdf
    • https://cdn-cms.f-static.net/uploads/4390330/normal_60176239c170e.pdf
    • https://cdn-cms.f-static.net/uploads/4466166/normal_5fdc1ae364321.pdf
    • https://cdn-cms.f-static.net/uploads/4480412/normal_604a5df70d630.pdf
    • https://cdn-cms.f-static.net/uploads/4445864/normal_6030a30c335e1.pdf
    • https://cdn-cms.f-static.net/uploads/4501041/normal_60697bbc0f2ae.pdf
    • https://cdn-cms.f-static.net/uploads/4490364/normal_602aace2a9b34.pdf
    • https://cdn-cms.f-static.net/uploads/4477626/normal_602a37e3d26c1.pdf
    • https://static.s123-cdn-static.com/uploads/4371495/normal_5fc62bc4c7de1.pdf
    • https://cdn-cms.f-static.net/uploads/4468819/normal_603e971029291.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://letonepamusi.pbworks.com/f/38567279404.pdf
    • http://kedetuwi.pbworks.com/f/gewuxebememebo.pdf
    • http://fodorafirig.pbworks.com/w/file/fetch/144435147/fixakuju.pdf
    • http://mifimoruzuwo.pbworks.com/f/adobe_creative_cloud_uninstall_command_line.pdf
    • http://lekuzax.pbworks.com/f/34748203989.pdf
    • http://gulisapil.pbworks.com/f/85388950070.pdf
    • http://kokoxudalux.pbworks.com/w/file/fetch/144428649/megupasudonozode.pdf
    • http://zigunef.pbworks.com/f/.pdf
    • http://foziwedugumu.pbworks.com/f/kedebo.pdf
    • http://jajafad.pbworks.com/f/how_to_descale_ambiano_coffee_pod_machine.pdf
    • http://visetululiv.pbworks.com/w/file/fetch/144416793/common_sense_thomas_paine_quotes.pdf
    • http://sejuworepow.pbworks.com/w/file/fetch/144419013/54771498722.pdf
    • http://marutipug.pbworks.com/f/rononutosajup.pdf
    • http://midevodimu.pbworks.com/w/file/fetch/144432948/wowasiri.pdf
    • http://taxexuwej.pbworks.com/w/file/fetch/144432783/23290206269.pdf
    • http://niwomif.pbworks.com/f/what_is_independent_auditors_report.pdf
    • http://xosufixemuf.pbworks.com/f/introduction_to_linear_optimization.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off0001428b.bin
ce72825a309fb8a05a03f0d0c90b93041513a2a2212ab5564724d280009d1219		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1428B 18112 bytes
font_00_sfnt_off0000fad2.bin
4dbe47739888dcfc1677af82b34c30bfd7808590eda42bc15700808cbe474c14		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFAD2 4428 bytes
font_01_sfnt_off00010a5f.bin
f2730d390623703d3369a6e4bddbc8d46b8a6f817e1cab3599bc86c4263beffd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A5F 5524 bytes
font_02_sfnt_off00011d06.bin
03c2a586264c61697c5aa2accc3c055c595e7f6615b0f02274a89656ec877600		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11D06 10968 bytes
font_04_sfnt_off00015e1d.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15E1D 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.