Malicious PDF — malware analysis report

Static analysis result for SHA-256 863b8e0f1984622a…

MALICIOUS

PDF

72.9 KB Created: 2021-04-15 08:42:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 77e9960b04c407a05579563880975b1f SHA-1: 74d2dc76d6d89afa39fb2f8abb0e2671f0f4ee3c SHA-256: 863b8e0f1984622a3120faba435e2e19f7148b27a759faf178969e0ece754090
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF file flagged by ClamAV as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, vilenefex.ru, which is likely used to host malicious content or redirect to a phishing page. The ML classifier also strongly indicated maliciousness. No scripts were extracted, but the presence of external URIs suggests an attempt to deliver a payload or phish credentials.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=triton+ii+sand+filter+leaking PDF link annotation
    • http://nesobaka9.xyz/the_royal_ranger_the_missing_prince_rangers_apprentice8kkva.pdfIn PDF document text
    • http://bobatorosas.mypressonline.com/backyard_bocce_ball_rules.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4464873/normal_603bfba9579a4.pdfIn PDF document text
    • http://fumizudo.sportsontheweb.net/kexaweluwogakenexo.pdfIn PDF document text
    • http://tuzazigigub.iblogger.org/12265619173.pdfIn PDF document text
    • http://alex-chekalev.com/87981425440y9u9v.pdfIn PDF document text
    • http://juvovagesubo.mywebcommunity.org/74809765530.pdfIn PDF document text
    • http://idealslimitaly.site/3341879796fle0r.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387424/normal_601bdfd21e92c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/tuzamada/cache_clearing_android_5.pdfIn PDF document text
    • http://suwugiborewetel.rf.gd/gidedemegipalaxawinuz.pdfIn PDF document text
    • https://s3.amazonaws.com/gonasidupij/albert_pike_morals_and_dogma_italiano.pdfIn PDF document text
    • http://fadudenomo.onlinewebshop.net/what_is_the_meaning_of_a_narrative_paragraph.pdfIn PDF document text
    • https://s3.amazonaws.com/rorives/kidupanixe.pdfIn PDF document text
    • http://setowejow.epizy.com/45107347226.pdfIn PDF document text
    • https://s3.amazonaws.com/jujadodedaruxix/dell_optiplex_390_lan_drivers_download_for_windows_7.pdfIn PDF document text
    • http://doriponesarom.myartsonline.com/adobe_dreamweaver_cs6_tutorial_espaol.pdfIn PDF document text
    • https://s3.amazonaws.com/watajive/complaint_template_nhs.pdfIn PDF document text
    • https://s3.amazonaws.com/nagudo/xafagivowebowapuva.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000deac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDEAC 5088 bytes
SHA-256: ad6ab2b9507f68b5387bbe12d312175119a41920a76eaae62dcac55944e2790a
font_01_sfnt_off0000f00b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF00B 11432 bytes
SHA-256: d9f022f57419356bfd5728f4d7a6a69e2c938d205f18c40ddbed1ab26b930835

Open this report in the interactive analyzer, or submit your own file for analysis.