Malicious PDF — malware analysis report

Static analysis result for SHA-256 83be7a68c50e49b7…

MALICIOUS

PDF

86.9 KB Created: 2021-03-07 03:07:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6bf863e9df4e2d4d6dd4a0debdced4aa SHA-1: 9cd1acbdb58de11ce8d724d5cd3d89e21b4a939a SHA-256: 83be7a68c50e49b7b8ae2530b06e13764dcbdfa6fd4fb60e266dabdb58f3bd56
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'maypoin.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, contains references to 'Tang dynasty technologies' and 'wkhtmltopdf', suggesting a lure to a malicious website.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=tang+dynasty+technologies
    • https://cdn.sqhk.co/pemejurove/ghjna58/ridegasobef.pdf
    • https://cdn.sqhk.co/ninujamezol/geFlhhV/jazagegofewubezelozave.pdf
    • https://cdn.sqhk.co/wisisatofife/jfgegd1/wood_cutter_machine_price.pdf
    • https://cdn.sqhk.co/girewobo/fRDogdE/79663190249.pdf
    • https://cdn.sqhk.co/winelolibug/hgdgdZL/chocolate_mousse_pie_recipe_easy.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/zerepuzuze/wijelinegaperab.pdf
    • https://s3.amazonaws.com/pukiza/16832399198.pdf
    • https://uploads.strikinglycdn.com/files/6c3361da-0473-4705-89ad-71ea02a276b7/nizezanegaroxafisiri.pdf
    • https://s3.amazonaws.com/minegikukovel/4821566041.pdf
    • https://uploads.strikinglycdn.com/files/9a589bed-9b51-4fb0-a2b2-8ace02ac2307/dungeons_and_dragons_female_character_names.pdf
    • https://uploads.strikinglycdn.com/files/0a29aea7-a917-41fb-903a-f894bece724c/keboj.pdf
    • https://s3.amazonaws.com/jozaponi/vilezewogoxusanoderivod.pdf
    • https://uploads.strikinglycdn.com/files/087e6d32-b7a2-438e-95b2-282c736a34a0/nabetowajadimagit.pdf
    • https://uploads.strikinglycdn.com/files/169e9130-7343-43e8-8682-cd6187204ccc/jejataperonasezutofufuboz.pdf
    • https://uploads.strikinglycdn.com/files/12ede433-ec62-479d-918c-cacf64d0a9e6/50737218339.pdf
    • https://uploads.strikinglycdn.com/files/f08011b1-6bc5-41f3-806f-db2f6741c7bc/how_to_write_a_script_for_a_training_video.pdf
    • https://uploads.strikinglycdn.com/files/c5f3897b-9a43-4808-9ac6-2e3e943c17f1/made_to_stick_book_amazon.pdf
    • https://uploads.strikinglycdn.com/files/17447a40-3ac8-4f04-a972-f17f73f8a05e/ponuwobat.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010cc6.bin
2dba4c16d9d75bdf8f46dc85b888f80b800d4c114f1e29d334a8155f1d109a23		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10CC6 3548 bytes
font_01_sfnt_off00011951.bin
ca2d3a9d418a727e0da8d6307eb6bced24894398ec5f21c49fc21ac37745e282		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11951 5156 bytes
font_02_sfnt_off00012ae7.bin
5eb2737c449ee1262bf010179bf29864575e342f3c8c20df9deef1ae838a3d36		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12AE7 10292 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.