Malicious PDF — malware analysis report

Static analysis result for SHA-256 8df58af614e08c33…

MALICIOUS

PDF

72.9 KB Created: 2021-03-22 13:06:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 47c4467c35ed79cf03e1524ee18652c6 SHA-1: ee8d084c41b72f9c51d27653c4b74424ab690c23 SHA-256: 8df58af614e08c339c3cc2b0b00eca9189cc7c853a264356a71b29a16bb84c32
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, and the document body text, though heavily obfuscated, includes phrases related to tracking and application metadata. ClamAV and ML classifiers strongly indicate maliciousness, consistent with a phishing or malware distribution lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=can+you+track+usps+first+class+mail+international
    • http://selectgetc.top/the_secret_rhonda_byrne_audiobook_freex6fb0.pdf
    • https://cdn-cms.f-static.net/uploads/4366365/normal_605188999e4f0.pdf
    • http://tehnotop.site/66917651587etf09.pdf
    • https://cdn.sqhk.co/sejujona/hdjfeKJ/puniziraxuvimuvupo.pdf
    • https://mitezexevas.weebly.com/uploads/1/3/4/5/134525922/ca76e9.pdf
    • http://bitsracing.net/duketifalepog0v1mr.pdf
    • http://yildirimotobursa.com/50290674107e3pp9.pdf
    • https://cdn-cms.f-static.net/uploads/4376357/normal_602eaa4332d1a.pdf
    • https://static.s123-cdn-static.com/uploads/4368243/normal_5ff16e0cae50f.pdf
    • https://cdn-cms.f-static.net/uploads/4458137/normal_601838b3cd787.pdf
    • https://rifituxajigibik.weebly.com/uploads/1/3/4/5/134519767/8220fa45.pdf
    • https://cdn.sqhk.co/pugirunosamo/hjQPXgf/98724091774.pdf
    • http://dayzcommunity.info/12549700029fenea.pdf
    • https://cdn.sqhk.co/kinuneba/4iegdge/movistar_plus_skam_espana_temporada_1.pdf
    • https://cdn.sqhk.co/fuvebopeweb/jdjjUcU/yeet_name_meaning_urban_dictionary.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://2a07c75e-e898-48ba-b326-4cccc82d0599.filesusr.com/ugd/ff154e_07f2f118e87b4f8e8b6df6dbafa0d29a.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3f2beec8-370f-4e84-969c-3079dc61a9cd/90841731973.pdf
    • https://uploads.strikinglycdn.com/files/50515d5e-a369-4e00-84d7-fea65e50fb52/how_old_was_friedrich_nietzsche_when_he_died.pdf
    • https://bdc3fad0-85dd-4e34-85f7-620d54d4ff6f.filesusr.com/ugd/10cedf_4e3748c6dbd540dcb94d9934bb7a2dbf.pdf?index=true
    • https://uploads.strikinglycdn.com/files/487330a1-6be0-4d72-a463-8adf5ccca73a/multivariate_analysis_of_variance_manova.pdf
    • https://5e3b32e6-a537-4a58-a531-ef303a468713.filesusr.com/ugd/120874_fb7638693bcc4a5f820d5cd74ec3113b.pdf?index=true
    • https://a98f38e8-5810-4fc9-be6a-c3d78c7c4f9f.filesusr.com/ugd/921909_ed4329408e7b4843a04a9f6bedc58c84.pdf?index=true
    • https://uploads.strikinglycdn.com/files/fdcc2e1b-cc29-4572-8533-68fc7a9e5fc7/3066751838.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e1c4.bin
e65b7ff885386372a63aa179978fb785abbb41ec6c62773e2121e4e2ecc846d7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE1C4 5232 bytes
font_01_sfnt_off0000f38a.bin
70446f01464ac15bae0867048aea19ee981190f0ad033429f2d6e2e1828a569d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF38A 10092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.