Malicious PDF — malware analysis report

Static analysis result for SHA-256 852a9cf9fab1e70d…

MALICIOUS

PDF

81.2 KB Created: 2021-03-15 03:13:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-17
MD5: 07f68a99e87df322c7b63beb49edaa6b SHA-1: 5c41430ac7ecb534f4c8da6f8c2a50c761bd54c1 SHA-256: 852a9cf9fab1e70d29c0ecc5701df7b6ba59764da61c9bdd55454bdfb6b4a414
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing obfuscated text and embedded URLs. The ClamAV detection and ML classifier strongly indicate maliciousness. The primary malicious URL, 'https://leonvi.ru/wix?keyword=fish+cheeks+quiz+answers', is presented within the document body, suggesting a phishing or redirection attempt. No scripts were extracted, but the PDF structure and embedded URI heuristic point to a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=fish+cheeks+quiz+answers PDF link annotation
    • http://pr-bux.online/pozanogetufemus15axy.pdfIn PDF document text
    • http://zuvels.xyz/196307057487kjxn.pdfIn PDF document text
    • http://inscarusa.info/imaginarium_premium_mountain_rock_train_table_setuzjfh.pdfIn PDF document text
    • http://becloud.website/35158755791hqlmy.pdfIn PDF document text
    • http://dorightpress.com/sodotuxa1e0yf.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xazarujokemus/gage_road_brewery_annual_report.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6a108e3b-dd09-4aa0-9b90-5377c3be7a3c/2292592550.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d7b6d0c3-168e-4fbf-974c-1b12b426d132/change_management_theory_in_nursing.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/81f4894d-24ab-4523-8630-a9746cbc5d99/36155606696.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/32066d98-2cce-43c5-9d22-b704035d577d/fefokiwetosapunezux.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1905fc39-f50a-4b35-b085-cef7897eb838/xitamuzixumusunekesibopal.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f5679cb2-1aa2-48ed-bc51-c2690d7cc43c/john_deere_42_plow_blade.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4c1671cf-cef0-40b7-8b79-5c5059a91790/penny_stocks_to_buy_now_september_2020.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7cc152b4-6892-4d33-9d1c-47bc36b55586/famur.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7c5f84c2-38af-42d7-98ef-2a4a3e10e713/55233124444.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/44961659-f64e-46fa-9ced-7b99d0d2bd3b/ross_medical_billing_and_coding_reviews.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/78ccd3b2-8f01-42b7-a780-01140d596781/16_pulgadas_cuantos_cms.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/50c781bf-b74c-4f58-95b8-d3ad6c12c23a/75880203821.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c8d81e97-a39a-4d7c-a3f4-c4603ea5ea86/the_witcher_books_good_reddit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dc386fd3-f882-4d2f-ae67-85cee65f1aba/dd_5e_class_character_sheet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e14fe733-71de-44f2-b5a1-42d1e40442df/40_80_meter_magnetic_loop_antenna.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cebffd57-2c64-4a9b-be46-0a3268b266f6/59320847467.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d5be1a10-02ec-443a-a237-7f4b4e80504c/vireremavolefuna.pdfIn PDF document text
    • https://s3.amazonaws.com/jujojomojemiz/86581407379.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010114.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10114 5140 bytes
SHA-256: b9b2b0b2c5f73fec61e60f326af5be8af35413e8450493945c07f30a8e1ff16c
font_01_sfnt_off000112b2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x112B2 10820 bytes
SHA-256: 0fa95f71fbc7b7072e9f26c247afb8393959ca9b2bd831320d8e846cb068ef5e

Open this report in the interactive analyzer, or submit your own file for analysis.