Malicious PDF — malware analysis report

Static analysis result for SHA-256 84b927a6fa0935c4…

MALICIOUS

PDF

831.2 KB Created: 2021-03-18 06:30:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a128e2bef9bd28082d0298960ce4abfd SHA-1: 1f3260e8aa2ee0e2a5ee3b4a835e1e6a7294cd3f SHA-256: 84b927a6fa0935c43a0693235246623e4b409d7a9c21af23f000a0688831b294
76 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains heuristics indicating an advance-fee scam, specifically mentioning lottery winnings or beneficiary funds and parcel delivery requirements. The embedded URL `https://xezojetit.ru/wix?keyword=mutual+dell+campground+reservations` is likely part of the lure or a redirection to a malicious site. While no scripts were explicitly extracted, the ML classifier and the nature of the lure strongly suggest malicious intent, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7989

Heuristics 4

  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=mutual+dell+campground+reservations
    • https://mofegagopabelem.weebly.com/uploads/1/3/1/4/131438130/561278.pdf
    • http://finipupote.mywebcommunity.org/dork_diaries_book_11_trailer.pdf
    • https://gojudewusidaza.weebly.com/uploads/1/3/4/8/134888042/891078.pdf
    • http://lebizifijafaxim.medianewsonline.com/resumen_del_libro_de_once_minutos_de_paulo_coelho.pdf
    • http://xezuviwejugume.22web.org/atwood_gc10a-4e_parts_list.pdf
    • http://berilunowalaz.iblogger.org/57834481772.pdf
    • https://nufewaxitobazat.weebly.com/uploads/1/3/4/7/134748461/f4ca082.pdf
    • http://wamuvosuvebupa.iblogger.org/s_letter_whatsapp_status_video_hd.pdf
    • https://lekevemu.weebly.com/uploads/1/3/0/7/130776436/7753962.pdf
    • http://zibikudupe.mywebcommunity.org/pemumube.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/julexekubaj/software_arcgis_10._1_free.pdf
    • https://10bc5e17-7652-4c7e-9b43-999b3eb3b021.filesusr.com/ugd/5edc69_4785649b8f8b4c4c8d162f2685c3eb7c.pdf?index=true
    • https://s3.amazonaws.com/rujabepifar/70578718820.pdf
    • https://s3.amazonaws.com/taguxif/butterfly_paper_cutting_free.pdf
    • https://s3.amazonaws.com/jeromisixinolib/flute_sheet_music_classical.pdf
    • https://ad858f6a-7bbb-416d-9365-e04d7986ed9b.filesusr.com/ugd/3c9ac1_e2c12ff01fc1431ab3710e12e3604a93.pdf?index=true
    • http://jadodokuzikibu.rf.gd/73143278290.pdf
    • http://mubadel.epizy.com/8332965252.pdf
    • http://mixipazotan.epizy.com/caesar_2_game_free.pdf
    • http://bizedesaxifu.onlinewebshop.net/how_long_does_a_kindle_oasis_battery_last.pdf
    • https://1e16da7b-5b4f-4122-a3c4-5c88c9d97cf7.filesusr.com/ugd/83f04e_54f88ccedf014615985cb5e1e9b2d1cb.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000ca10e.bin
9cc975c12777ccee59f3b652e68ae0ddc782e9b5adc40757db0a8806438d4987		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCA10E 5340 bytes
font_01_sfnt_off000cb326.bin
32401cd846b9cfaad4c6d2c321dbd0bbdcb7b6f5c326ca7e6dc972f65c3455eb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCB326 14052 bytes
font_02_sfnt_off000cdef4.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCDEF4 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.