Malicious PDF — malware analysis report

Static analysis result for SHA-256 8925b2b2799a22a2…

MALICIOUS

PDF

75.5 KB Created: 2021-03-20 07:32:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 91d4a0b78ca31f6345a3bd449a919217 SHA-1: 7fc5fb2b0a84787e2ad4d363d644d7cb1fa1dc86 SHA-256: 8925b2b2799a22a28cfc24c427f668b73cd15fc7d7296101b6dc629e8b0a1890
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, vilenefex.ru, which is likely used to host a malicious payload or redirect to a phishing site. The document body, though heavily obfuscated, suggests a lure related to 'Zorba the greek restaurant', likely a pretext to encourage user interaction with the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=zorba+the+greek+restaurant
    • https://cdn.sqhk.co/jategumeb/eqggge6/billie_eilish_bad_guy_live_glastonbury.pdf
    • http://rentline.pro/43969103579yl8n7.pdf
    • https://cdn.sqhk.co/tuxonewebuke/oNHQDeq/pirelonuwedefusafurugiku.pdf
    • http://martakkord.ru/kurerunesarepevopemixeqkfq4.pdf
    • http://tifusavegapawuf.mygamesonline.org/active_and_passive_voice_quiz_with_answers.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/cecd783c-39e2-4508-b097-90aeab5bdfba/pema_chodron_guided_meditation_audio.pdf
    • https://uploads.strikinglycdn.com/files/7e87a8d3-1e36-427d-99b7-086d64c1cc06/wowavobawovavuladarit.pdf
    • https://uploads.strikinglycdn.com/files/c8193e4a-933d-4edd-a05b-e9b3ec367297/joxosu.pdf
    • https://uploads.strikinglycdn.com/files/6806c309-044d-4f1c-87b8-5af09df91c59/vekera.pdf
    • https://s3.amazonaws.com/juwofuxufijup/83413275135.pdf
    • https://s3.amazonaws.com/pipaneku/what_is_a_special_needs_teaching_assistant.pdf
    • http://xejawaji.myartsonline.com/gasudenojigozuxij.pdf
    • https://uploads.strikinglycdn.com/files/0c5fec80-8895-44fd-9bb9-8bb666b00d9a/cognitive_behavioural_therapy_for_dummies_book.pdf
    • https://uploads.strikinglycdn.com/files/6a558ca1-4127-4a75-86ab-6c23240e2d72/hayward_pool_heater_error_codes_bd.pdf
    • https://uploads.strikinglycdn.com/files/c2ecfdf6-7cf6-4187-b66f-2ec87f51e62c/61682069163.pdf
    • http://taroveruwidiba.onlinewebshop.net/acero_aisi_1020.pdf
    • https://s3.amazonaws.com/lopeteb/evernote_apk_for_pc.pdf
    • https://s3.amazonaws.com/zifilobesumafi/file_biennial_report_new_york.pdf
    • https://uploads.strikinglycdn.com/files/cb9a4c81-1fcf-4689-8cca-795121b58818/36027556374.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cadf.bin
23d84c1a74e26473b918f2eeb6fca957a9ec5eb587b79b3da7f8827b3bd69f3a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCADF 5076 bytes
font_01_sfnt_off0000dc18.bin
1182553af4e4e1d4f08dc5c53a41ba3cf7bb24133579164eb638a84c8e765df2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDC18 2012 bytes
font_02_sfnt_off0000e54b.bin
52e6398fb5f852dd6ce1baf7c59d242163edc0ae9acd7c3d2342eadee6db65df		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE54B 11332 bytes
font_03_sfnt_off0001093e.bin
7e0863d6dcdfe3ce59f67395a06e5e8634226e44f713773c85e494ff6d119ee1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1093E 16344 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.