Malicious PDF — malware analysis report

Static analysis result for SHA-256 82a3bf7226cc0ab1…

MALICIOUS

PDF

76.8 KB Created: 2021-03-30 08:38:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4cbec274ec3898fdb385c64fbaaf3b27 SHA-1: ae605bf7f0bb9d49023b430ba0fe132d10992cb3 SHA-256: 82a3bf7226cc0ab10c281703f16d228468abd7ef97d32ed5beeb18734a94cc19
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, indicating a high likelihood of malicious intent. It contains multiple embedded URLs, with the primary one being https://druttle.ru/wix?keyword=linda+goodman+pdf+gratis, suggesting it's part of a phishing or scam campaign. Although no scripts were explicitly extracted, the presence of PDF_URI and EMBEDDED_URL heuristics points towards the file's function as a lure to external malicious resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9952

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=linda+goodman+pdf+gratis
    • http://ins.expert/34515026338yrqdo.pdf
    • https://cdn.sqhk.co/kajutizikodu/aijuHjd/how_to_view_my_icloud_pictures.pdf
    • https://cdn-cms.f-static.net/uploads/4426676/normal_604ef78f0b8fb.pdf
    • https://cdn-cms.f-static.net/uploads/4377674/normal_603c48035b44b.pdf
    • https://static.s123-cdn-static.com/uploads/4451039/normal_5fc5c0f218ced.pdf
    • https://cdn.sqhk.co/vupapevixu/qIRXjcu/formula_one_racing_games.pdf
    • https://cdn.sqhk.co/tevosenijosu/jcBp1cn/13885534662.pdf
    • https://cdn-cms.f-static.net/uploads/4369651/normal_605a46260de51.pdf
    • http://jonebukusopovet.mygamesonline.org/tewobevekidunutezororef.pdf
    • http://zujewubowufonug.scienceontheweb.net/2021373688.pdf
    • http://websporizle3.com/skyrim_coldharbour_mod3si9i.pdf
    • http://veruvipavopa.getenjoyment.net/the_merry_adventures_of_robin_hood_chapter_4_summary.pdf
    • https://cdn-cms.f-static.net/uploads/4499636/normal_600ef613b9645.pdf
    • https://cdn.sqhk.co/vameduvide/ic07eia/94971965128.pdf
    • http://golixudib.mypressonline.com/4105621061.pdf
    • http://fudoviwil.mywebcommunity.org/navy_blue_cooling_neck_gaiter.pdf
    • https://cdn-cms.f-static.net/uploads/4448357/normal_602fad582b0e1.pdf
    • http://fitokaps.xyz/sovimutiruvuroxunoxewb9tl.pdf
    • https://cdn-cms.f-static.net/uploads/4421215/normal_60159620ea379.pdf
    • https://cdn.sqhk.co/segenoliz/ghl0npV/20535221321.pdf
    • https://cdn-cms.f-static.net/uploads/4484631/normal_60605a570d22b.pdf
    • http://vuvuga.xyz/33441582076iaxb2.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/82cb1f3a-e7a4-4c9c-b95a-534cce0f5a00/wall_street_journal_sales_letter.pdf
    • https://uploads.strikinglycdn.com/files/3e86fa61-7ad1-4d31-ab6d-f5adc6a3cd4e/zibolagisexuni.pdf
    • https://uploads.strikinglycdn.com/files/a9134d7c-e78b-47fa-a6e3-befdabad797a/suzuki_125cc_dirt_bike_2_stroke.pdf
    • https://uploads.strikinglycdn.com/files/9d5f6ba2-bfbf-4a4a-b819-a56424074928/jomojegob.pdf
    • https://uploads.strikinglycdn.com/files/fc3e845c-b3fe-4b13-b987-f326d317fabc/sesosigawijajeladarewi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e918.bin
dfa52f747c9abfa248edccb2853b98328bf05aa0292f9600ea46a87f7a0595a1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE918 5272 bytes
font_01_sfnt_off0000faf7.bin
2eb603ccf9277f478871b5dd90f468efaf6eee50ba152600969c5065cd413854		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFAF7 12804 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.