Malicious PDF — malware analysis report

Static analysis result for SHA-256 8357937d4ae934f4…

MALICIOUS

PDF

82.3 KB Created: 2021-03-19 05:31:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 27421115a75daf16f5d13a5da0716ab9 SHA-1: e0d4448282c70d15f08e226473597f188297210b SHA-256: 8357937d4ae934f41a1cd6b39d17a401fba67a54d54e45d6fe56ad436ee53425
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, identified as malicious by ClamAV and an ML classifier. The document body, though heavily obfuscated, suggests a lure related to 'camisole pattern pdf'. The presence of embedded URLs indicates an attempt to redirect the user to a malicious site, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/123?utm_term=camisole+pattern+pdf
    • https://kogejuxo.weebly.com/uploads/1/3/1/6/131606118/fotarur.pdf
    • https://cdn.sqhk.co/dowepigakaw/iagj6ia/mortal_kombat_11_unlock_characters_switch.pdf
    • https://cdn.sqhk.co/muvetowiripa/bjbVBgf/telegram_x_beta_ios_download.pdf
    • https://cdn-cms.f-static.net/uploads/4390366/normal_5fe60dc81ea76.pdf
    • https://wifojulov.weebly.com/uploads/1/3/1/4/131438113/kofaxede.pdf
    • https://majotowuwirup.weebly.com/uploads/1/3/5/3/135346036/5629399.pdf
    • http://rolevuses.iblogger.org/deficiencia_de_vitamina_b12_sintomas.pdf
    • https://nusoselif.weebly.com/uploads/1/3/4/4/134470887/66e25b5b4.pdf
    • http://zakukamupavi.22web.org/html5_email_template_builder.pdf
    • https://cdn.sqhk.co/manigonodapu/iajd5MW/mejikedikupeziseg.pdf
    • https://resagivet.weebly.com/uploads/1/3/1/3/131383325/sajifetepipakaxagude.pdf
    • https://cdn-cms.f-static.net/uploads/4391954/normal_6033374917495.pdf
    • https://static.s123-cdn-static.com/uploads/4377095/normal_5fdf11f5b78de.pdf
    • https://cdn.sqhk.co/libibajuzumu/idtZ6id/breaking_into_wall_street_400.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://robebiwasufilu.epizy.com/how_do_you_determine_the_age_of_a_york_furnace.pdf
    • https://f6e2a16f-d004-42cd-8f17-0463e090774c.filesusr.com/ugd/c70c35_2f2a97bad9f44418a029ed4c48c4abf4.pdf?index=true
    • http://xenuduximowub.epizy.com/82080527140.pdf
    • http://devagejoga.rf.gd/spelling_words_for_4th_graders.pdf
    • http://kegonen.rf.gd/cumulative_frequency_graph_gcse_questions.pdf
    • https://141ebdc9-a3c9-4c6d-b8f9-366dbf139dec.filesusr.com/ugd/46bfb0_6080520102204d6fb03dad01f874e2b7.pdf?index=true
    • http://bowukedogatowo.epizy.com/lovarusilujifid.pdf
    • https://0dd0cd87-80d3-4eb5-b9c6-73c43c3a6fca.filesusr.com/ugd/f0b6b3_c64ccd7c33374d3cbd42f4683ba954f8.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dda0.bin
cdf3e4437fd7427beda43e4261d0132bd85b92156f1a14adae8178026943dabb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDDA0 6908 bytes
font_01_sfnt_off0000f563.bin
318521047e514c68d9badfc7d19297f73d8ca5523a4be617bdf66e04ced348b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF563 5000 bytes
font_02_sfnt_off00010648.bin
a54ea899260b51161177db7542fc9dee82d5651876808dd80c5e405a73ff89f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10648 11492 bytes
font_03_sfnt_off00012d6d.bin
a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12D6D 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.