Malicious PDF — malware analysis report

Static analysis result for SHA-256 860ffe7f42db3bc2…

MALICIOUS

PDF

174.9 KB Created: 2021-03-18 08:59:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: 09cd343456573dcc60026cf68a060af7 SHA-1: fd58ca08f8460f687d190500bd68312b8a98d575 SHA-256: 860ffe7f42db3bc2572c2d25c9df6127d669653f5fa37ab135ab11da091a36b9
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF file that contains an embedded URL pointing to a suspicious domain. The ML classifier and ClamAV detection strongly indicate maliciousness. The presence of an external URI and embedded URLs suggests an attempt to redirect the user to a phishing or malware distribution site, likely as part of a spearphishing campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9978

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/award?keyword=asthma+gina+guidelines+pdf PDF link annotation
    • https://tibiwurab.weebly.com/uploads/1/3/2/6/132695994/vomekagakitadifuwus.pdfIn PDF document text
    • https://zukutalemuz.weebly.com/uploads/1/3/4/5/134582669/4000838.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/zafaronivaj/excel_project_schedule_gantt_chart_template.pdfIn PDF document text
    • https://c370dac7-4848-4fa0-a6df-94361299e8ba.filesusr.com/ugd/fa6303_c9ba1cb5d9734750b903b166410f9041.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jaxesabi/16920516698.pdfIn PDF document text
    • https://s3.amazonaws.com/lebejos/wevugajuranivesedobola.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/264588c2-2ade-40a2-ad17-7fb3753b6e6f/88253431221.pdfIn PDF document text
    • https://7382f664-3a3a-4b84-9c04-90301528964b.filesusr.com/ugd/4b68be_f32e3d128fff4478bfef033f514abaca.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/lusabifef/molotorizotoxunuxo.pdfIn PDF document text
    • https://9387bd13-3746-4408-b474-2867f26e464d.filesusr.com/ugd/ace02d_d0e5f7c2cd104d68ab489abb0ba7bad8.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gogunabones/renetefudegukefef.pdfIn PDF document text
    • https://s3.amazonaws.com/donake/84792025707.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6f863335-18e6-40e0-a0ee-3514f36bc30a/nomiwib.pdfIn PDF document text
    • https://s3.amazonaws.com/luramamelolem/creed_ii_imdb_parents_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/bidivo/shepherd_bushiri_books.pdfIn PDF document text
    • https://s3.amazonaws.com/rixevozajixezos/bursary_form_croydon_college.pdfIn PDF document text
    • https://s3.amazonaws.com/zobuwubedak/40_rules_of_love_book_in_urdu.pdfIn PDF document text
    • https://s3.amazonaws.com/zozofufulolig/rca_tablet_dvd_combo_reset.pdfIn PDF document text
    • https://f110cc6a-49d6-427c-9ab6-a3a4d323b004.filesusr.com/ugd/9e53d4_a8e21a53906545e591b13d94348837b8.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zafijukopa/silizezib.pdfIn PDF document text
    • https://51f47fa2-20f7-4ec4-bb91-8ae4aee689b4.filesusr.com/ugd/917232_6e367312e40d42728f1cc684fdf6c421.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zetubakuz/88624488825.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00025836.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x25836 5348 bytes
SHA-256: 88e0cc17c58bca2ac7390bd46b3754346a72458c8ad72c4d450ee9c4a5edd6b2
font_01_sfnt_off00026a45.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x26A45 14064 bytes
SHA-256: 1571966c16564a9c1876044f16f78487f8029daa0ecddbd32dba22b4245b1e4c
font_02_sfnt_off0002978b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2978B 16164 bytes
SHA-256: b78d03010f93fc526513a5bd4a7b4c578af812224dd9dd9f08c56bc7bb81827a

Open this report in the interactive analyzer, or submit your own file for analysis.