Malicious PDF — malware analysis report

Static analysis result for SHA-256 84e21df85553f2b9…

MALICIOUS

PDF

84.2 KB Created: 2021-03-12 04:00:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 50ccdb5ce9e813fe4ce321feb428d183 SHA-1: de383e6dcb64c2cefc029473f605c555be186eff SHA-256: 84e21df85553f2b9568ecdd3c62d9bd6c95720ddac6a54c7dbcce8271bd45c45
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains an embedded URI pointing to 'https://maypoin.ru/123?utm_term=bagatelle+pour+un+massacre+celine+pdf', which is a strong indicator of a phishing or malware distribution attempt. The document body, though heavily obfuscated, suggests a lure related to a book title, reinforcing the phishing pretext.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/123?utm_term=bagatelle+pour+un+massacre+celine+pdf PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4490127/normal_5fca72888b3a0.pdfIn PDF document text
    • http://1fps.ru/sujisopa0ilw5.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4496586/normal_5fcba0d5cfabf.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454977/normal_5ff66292e08c0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4425507/normal_600a60504482e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4414852/normal_5fca58775ff9b.pdfIn PDF document text
    • https://cdn.sqhk.co/manaruparil/ghy07ii/bubble_hero_2_pc_download.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4372377/normal_5ff2723ad6ddf.pdfIn PDF document text
    • http://kigurumi.org/label_tectonic_plates_worksheet_ks2vkex9.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4465938/normal_5ff65a8c50283.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4424400/normal_604aab9330469.pdfIn PDF document text
    • http://hargotel.xyz/63764395798n4qhu.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4464080/normal_60071b38a2ecd.pdfIn PDF document text
    • https://cdn.sqhk.co/wigalefu/hjdQghZ/cake_decorating_ideas_for_beginners.pdfIn PDF document text
    • http://by-roof.ru/10555488549xgodl.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4453098/normal_5ff97ec0934ab.pdfIn PDF document text
    • http://spindlndou.space/29072952629udwrr.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4389101/normal_5fece953077d7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4401694/normal_6033377883801.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/37e114ce-a19f-4bc5-9395-daae45b8cc95/shear_rate_calculation_pipe_flow.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1dc577a0-ff83-46cb-9cef-64de06eb1a90/76145494735.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3523040b-6c71-4fe1-96aa-527770c1892d/jawoxolepub.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/074d73e3-b268-4d8c-9bf5-358afcd7990f/24649736667.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fb14.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB14 5404 bytes
SHA-256: 1ac7b7d0c1f7948a6e32a5c0f9a369c407f4233ea7b3fbdf95fe342b2f7440dc
font_01_sfnt_off00010d53.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10D53 12444 bytes
SHA-256: 9223112214b9ec137a4f6a208f9a3752e4049d806151b754ba9b3a618ca67f7b
font_02_sfnt_off00013544.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13544 4324 bytes
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378

Open this report in the interactive analyzer, or submit your own file for analysis.