Malicious PDF — malware analysis report

Static analysis result for SHA-256 849fbfbbf5179e15…

MALICIOUS

PDF

80.1 KB Created: 2021-03-29 01:21:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 623e1adb834cb8130a851d133fcd10db SHA-1: 22d3adab0facd32167700f39c99bf2d7647a729e SHA-256: 849fbfbbf5179e15d61fcfd0694c4ad0ad3f0aa7a4ebf553c7ad223e75d305ba
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, which is a strong indicator of a phishing or malware distribution attempt. The ML classifier and ClamAV detection further confirm its malicious nature. The document body, though heavily obfuscated, suggests a lure related to an 'online image outline tool', likely a pretext to redirect the user to the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=online+image+outline+tool
    • https://cdn-cms.f-static.net/uploads/4501229/normal_60586ac04410b.pdf
    • http://tokio-2020.fun/wosomop93f81.pdf
    • https://cdn-cms.f-static.net/uploads/4498345/normal_6013359388881.pdf
    • http://shop-profildoors.ru/bloodborne_pack_by_team_talev6ya.pdf
    • https://xuxasogunoniku.weebly.com/uploads/1/3/1/8/131856570/8328829.pdf
    • http://nikaold.site/533151830950tp9y.pdf
    • http://gakmancreatures.ru/59618339324aon8l.pdf
    • https://cdn-cms.f-static.net/uploads/4365586/normal_604460594d54e.pdf
    • http://opencabinets.xyz/56023664916vzj5y.pdf
    • http://storeyou.store/6926759941700q5e.pdf
    • http://sport-stavki.fun/sony_dcr-sx63etfmyz.pdf
    • https://bogekivusuwi.weebly.com/uploads/1/3/4/6/134604255/ece9c0c.pdf
    • https://static.s123-cdn-static.com/uploads/4503578/normal_5fc61336e80f3.pdf
    • https://reralifinopu.weebly.com/uploads/1/3/4/0/134018386/zijep_wabetobez_fabepon_xenuzaki.pdf
    • http://frukt.fun/xupudedugenonufuxarobozzfbj.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://f238abdf-92e3-4651-90df-65b6e8a648d9.filesusr.com/ugd/99965f_cd8d93cbe58b4165921ce1d24a8b983f.pdf?index=true
    • https://s3.amazonaws.com/remuv/song_of_ice_and_fire_book_6_release_date.pdf
    • https://s3.amazonaws.com/buganabowumujef/gosick_ed_sheet.pdf
    • https://587b455d-cc79-4428-8e80-a8b75ce23bca.filesusr.com/ugd/021ec8_4c34e3b4f2ab4f8f8765bce82b552f4e.pdf?index=true
    • https://s3.amazonaws.com/jawusawar/vinumakiga.pdf
    • https://s3.amazonaws.com/gavapozalilup/craftsman_weed_eater_17_25cc_parts.pdf
    • https://s3.amazonaws.com/pubopelej/30915388850.pdf
    • https://76c9fb28-c10e-4950-85be-37de24a2ede8.filesusr.com/ugd/fa32a6_56b697faf1704629a26e0ba7a8302b4b.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed66.bin
8dc30d9ff3698b8d76e7ab302270717c4ce8f1c55803be0315b522b2e6cc330c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED66 4640 bytes
font_01_sfnt_off0000fd17.bin
5dfbf8e70dd4592048b01d5e8650c0efe46267b1f23373a7a4c774e13cd1df44		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD17 11212 bytes
font_02_sfnt_off00012372.bin
7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12372 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.