Malicious PDF — malware analysis report

Static analysis result for SHA-256 838395084c33d5da…

MALICIOUS

PDF

70.8 KB Created: 2021-03-13 21:58:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: 49ec5192a4137bbb4f889de5abebfef2 SHA-1: de58793c8480d4575a752b0c935ce63a418565ae SHA-256: 838395084c33d5da11f8f2b0ce04203021f189cdcd5fc80bda4fd95593c8e645
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, likely used to redirect the user to a phishing or malware download site. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool sometimes used to create malicious PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=maytag+quiet+series+200+door+latch PDF link annotation
    • https://fozaxebefi.weebly.com/uploads/1/3/4/5/134584315/gukexenagubep-bezet-ganokafawib-vukufiluduz.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485576/normal_5fe721ad204ac.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445570/normal_603697920ef6e.pdfIn PDF document text
    • https://cdn.sqhk.co/xovikojux/hcgege3/ninja_shake_blender.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376879/normal_604ceb27b27b7.pdfIn PDF document text
    • https://cdn.sqhk.co/konajera/zRggGig/jivagepexasetagakaliwije.pdfIn PDF document text
    • https://cdn.sqhk.co/fodibaniwe/ahjMy9D/jolufu.pdfIn PDF document text
    • https://firulasimasib.weebly.com/uploads/1/3/0/9/130969438/dodobezawiliw.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4393364/normal_60014ab66120c.pdfIn PDF document text
    • https://cdn.sqhk.co/diridenafa/47jbVCU/case_knife_money_clip.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4392656/normal_5fccda0134c42.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4488570/normal_5fcdcc6a5690b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4477649/normal_6031d8de60e72.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4485580/normal_6002e1e8ec1a9.pdfIn PDF document text
    • https://tewiwumorivare.weebly.com/uploads/1/3/1/4/131409909/jejadof.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4447641/normal_5fde9a841de3c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4376852/normal_5ffa25c99a305.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4474734/normal_60445ddb41eba.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4451374/normal_5fcbcab86122e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/fd3e5ec4-7a36-4443-9229-b0518c1279bc/pretty_little_liars_season_3_episode_13.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e8b3bd3f-d714-4cf6-a369-53a3533d40ef/who_are_the_rich_brothers_gardeners.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5b9a8b66-6893-4630-8fbb-86fe4d96ad2b/how_to_change_cutting_blades_on_husqvarna_riding_mower.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e42496a4-03e8-4bdf-9c65-326fd470c1ed/27041806183.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1616d75d-9ecf-4b8a-96b4-f3f635ef9a85/86599019468.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d600.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD600 5708 bytes
SHA-256: 7c84a534077867077925588097fe74f469c54425c53139ae14f9c03a53ae5737
font_01_sfnt_off0000e975.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE975 10484 bytes
SHA-256: 68d63eacf0dcd7fe101c7b4c29591fa870fb4a2f653b9bb1ac6d97af9143ee7b

Open this report in the interactive analyzer, or submit your own file for analysis.