Malicious PDF — malware analysis report

Static analysis result for SHA-256 87afe7bb7cd9eb4e…

MALICIOUS

PDF

97.6 KB Created: 2021-03-16 21:54:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 498461505dae0938ecbbe6695155a5aa SHA-1: 2b785fe90050e2aa7e5e4fca6b7824b67e178d2e SHA-256: 87afe7bb7cd9eb4e211adbd59661e9f91444514607e233f2e06f515ca265539f
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses a fake browser/software-install lure. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/123?utm_term=oracle+11gr2+quick+installation+guide+linux PDF link annotation
    • https://cdn.sqhk.co/gitaligido/jcihHqs/sumuwapu.pdfIn PDF document text
    • https://cdn.sqhk.co/tiviluluje/PvjfTgc/suxixanawe.pdfIn PDF document text
    • https://cdn.sqhk.co/xaripisi/a4fjik3/retro_arcade_game_reviews.pdfIn PDF document text
    • https://cdn.sqhk.co/duvetezoje/Piehdgd/malizazufegasilegekiba.pdfIn PDF document text
    • https://cdn.sqhk.co/suxupijisajo/igQ1Aif/6569500901.pdfIn PDF document text
    • http://komamoj.22web.org/zudowavusovenovavususa.pdfIn PDF document text
    • https://cdn.sqhk.co/madufuxenuw/0Ncn5ge/exothermic_examples_in_everyday_life.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://jerokiguwipifo.rf.gd/74401941619.pdfIn PDF document text
    • http://kedekivotizera.epizy.com/exponent_and_scientific_notation_study_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/wunupalezozerud/rovidoxevafo.pdfIn PDF document text
    • https://s3.amazonaws.com/lixisariwulo/niviruwujutipepetome.pdfIn PDF document text
    • https://s3.amazonaws.com/lerezazo/can_a_12_year_old_watch_twilight.pdfIn PDF document text
    • http://jiporeve.epizy.com/kufajolixutolevudizufij.pdfIn PDF document text
    • https://s3.amazonaws.com/wujixus/32578592669.pdfIn PDF document text
    • http://sewasijibakel.epizy.com/delegation_of_authority_matrix.pdfIn PDF document text
    • http://lulevewutowa.epizy.com/radalume.pdfIn PDF document text
    • https://s3.amazonaws.com/legobegutulo/avery_weigh_tronix_fairmont_mn.pdfIn PDF document text
    • http://bavuveba.epizy.com/11106819560.pdfIn PDF document text
    • https://s3.amazonaws.com/gimufesajo/jovorozaj.pdfIn PDF document text
    • http://mujasanowagug.epizy.com/injury_report_denver_broncos_baltimore_ravens.pdfIn PDF document text
    • https://s3.amazonaws.com/kisagoz/25750429887.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013cdd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13CDD 5576 bytes
SHA-256: 6be60488c5977819f3fa16ec639a3bc75bb882759e16b13c832353bfd1b2b07a
font_01_sfnt_off00014fe6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14FE6 11436 bytes
SHA-256: 8be95f44cf368b8676315faa90ab123e8f99c0f6cdb3bf5cb45007c7116e89ef

Open this report in the interactive analyzer, or submit your own file for analysis.