Malicious PDF — malware analysis report

Static analysis result for SHA-256 8730e4629eac9c4e…

MALICIOUS

PDF

76.6 KB Created: 2021-03-18 05:58:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: c98fd5344c869ae6fc24146ef964c0ab SHA-1: 0e69a9aaf0072523e451290a9f92ac8c171c2212 SHA-256: 8730e4629eac9c4e4864e61269246bfcc8383bff53b1b6f42696d01cf24a945a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. It contains an embedded URL pointing to a suspicious domain, which is likely used to deliver a secondary payload or conduct phishing activities. The document body, though heavily obfuscated, contains references to 'review' and 'wkhtmltopdf', suggesting a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/strik?utm_term=fostex+mr-8hd+review PDF link annotation
    • https://cdn.sqhk.co/tatiwurixiwo/zChjhjl/beraxusofenibel.pdfIn PDF document text
    • http://tebapewulodafe.getenjoyment.net/wemibikunujumogovakiv.pdfIn PDF document text
    • http://pawezujexas.mywebcommunity.org/fefegoma.pdfIn PDF document text
    • http://lezeninimi.medianewsonline.com/annotated_bibliography_mla_sample.pdfIn PDF document text
    • https://cdn.sqhk.co/jilowepe/gdii8if/chargepoint_map_legend.pdfIn PDF document text
    • https://cdn.sqhk.co/demejapad/e6Ogcjh/91944348192.pdfIn PDF document text
    • https://cdn.sqhk.co/sivofedexim/hggjigf/subterfuge_definition_for_dummies.pdfIn PDF document text
    • http://nuloriwilorij.scienceontheweb.net/felofapopesipowilub.pdfIn PDF document text
    • http://pifedalune.medianewsonline.com/99652613984.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/wokesabisevo/addition_worksheets_for_4th_class.pdfIn PDF document text
    • https://s3.amazonaws.com/fekaduvopigab/college_algebra_math_problems_and_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/jobavo/fly_away_home_piano_sheet_music.pdfIn PDF document text
    • http://jibimom.myartsonline.com/xafogibawegadirojut.pdfIn PDF document text
    • https://s3.amazonaws.com/gotijejaj/68724941935.pdfIn PDF document text
    • https://s3.amazonaws.com/rimepusox/azhage_azhage_original_video_song.pdfIn PDF document text
    • https://s3.amazonaws.com/juliziwojatige/system_format_exception_c_try_catch.pdfIn PDF document text
    • http://siniligavaxuvul.onlinewebshop.net/tarizubokonetowolerepu.pdfIn PDF document text
    • http://mitofozajibo.rf.gd/fasuvalonanodosozuluk.pdfIn PDF document text
    • http://nudifezidezi.rf.gd/puwibomugudifiloz.pdfIn PDF document text
    • https://s3.amazonaws.com/vukujidor/46846777123.pdfIn PDF document text
    • http://pudekixepubaz.epizy.com/bepajam.pdfIn PDF document text
    • http://fixadamobus.epizy.com/91431601146.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eece.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEECE 5224 bytes
SHA-256: 82c0b9cde77e3f14ec47c3c585bac7dba2c8dab663f7af83b83e5679e1f9a8bb
font_01_sfnt_off0001008a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1008A 10800 bytes
SHA-256: 5eb3d8ec9ebbba9b8a5aa7ac4d4b4c2b049ee1f99eea76b4aed73c71f30f1a80

Open this report in the interactive analyzer, or submit your own file for analysis.