Malicious PDF — malware analysis report

Static analysis result for SHA-256 8d97e3c006a5ddbb…

MALICIOUS

PDF

77.4 KB Created: 2021-04-06 19:44:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c489a087f33c6b5540d9f6cb72cab66a SHA-1: 8a93053c4619330fef1399f62ec125480046e8c1 SHA-256: 8d97e3c006a5ddbb96985bbbd694c39534b82c4633e6731816a12ea83bb81085
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, which is highly indicative of a phishing lure. The ML classifier and ClamAV detection strongly suggest malicious intent, likely to redirect users to a phishing site disguised as a legitimate download. No scripts were extracted, but the presence of external URIs and the overall classification point to a phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/award?keyword=arrival+of+the+birds+piano+sheet+music+pdf
    • http://lighttravel-ng.com/how_to_set_goals_for_your_sales_teami5qe4.pdf
    • http://tilosag.mypressonline.com/69810051614.pdf
    • http://vclean-sale.shop/987395552623gh4w.pdf
    • http://kutejovanog.getenjoyment.net/20586786595.pdf
    • https://cdn.sqhk.co/webaxepibi/iQhcojf/ufc_251_news_now.pdf
    • http://scandisvet.ru/rowagori7q1xk.pdf
    • https://cdn.sqhk.co/gabironero/ifAsjax/farming_jobs_in_texas.pdf
    • http://heartcenteredequestrian.com/balloon_shooting_games_for_pcn1d2r.pdf
    • https://cdn.sqhk.co/fiduzosi/jfZJhap/4_pics_1_word_level_1827.pdf
    • http://viwavidif.getenjoyment.net/nejebitobuje.pdf
    • https://cdn.sqhk.co/bugininaxi/vOmSZie/formula_ounces_by_age_chart.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/11c0e281-b4b8-4921-ba8d-1cd69ab0987c/carry_on_suitcase_with_removable_wheels.pdf
    • https://uploads.strikinglycdn.com/files/34c523d1-9da2-495a-bf30-c12ad5990324/vuzajidadavazed.pdf
    • http://rumavajusugeg.rf.gd/beyond_the_sea_piano_sheet_music.pdf
    • http://zugawixiwo.rf.gd/17493544289.pdf
    • http://feliruxitekul.epizy.com/zorabebig.pdf
    • http://ravesezubepad.epizy.com/inorganic_chemistry_notes_jee.pdf
    • http://pojoresoma.rf.gd/socialismo_libertrio.pdf
    • http://selifesupenikiv.epizy.com/sidexi.pdf
    • https://uploads.strikinglycdn.com/files/2fb74cfb-1f8b-4ed4-aebc-4d535e43e7fb/puntos_de_partida_10th_edition_access_code.pdf
    • http://jipesofu.rf.gd/stay_tuned_for_more_information.pdf
    • https://uploads.strikinglycdn.com/files/c64d84ca-c007-4c8b-8f9e-7b16689e76c4/fenesugirizivemariviwevur.pdf
    • http://sabepusejoponi.epizy.com/blood_groups_and_their_importance.pdf
    • http://nubirumoxid.onlinewebshop.net/ctet_7_july_2020_question_paper.pdf
    • https://uploads.strikinglycdn.com/files/de7da0ae-9edd-485e-8d28-bf8fb2db3bef/65566321550.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed1b.bin
eb805ab77ab8d7db838b975b2443edebd01ae9c256aa558a2055eef9212d278e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED1B 5584 bytes
font_01_sfnt_off0000fff4.bin
f1f6868fe8169074bed658be8807df18c589812486f06c0aa3cfd686d4e21f9e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFFF4 11884 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.