Malicious PDF — malware analysis report

Static analysis result for SHA-256 8e177eede2e4eb04…

MALICIOUS

PDF

74.9 KB Created: 2021-06-02 06:54:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 9d1dd8bbce28756a23a41eec681e2143 SHA-1: 488f9a73a3cab70316983be49a0f438ecbea316a SHA-256: 8e177eede2e4eb04777c19d367f7b8a5e7a2e1304c01fce35d0d0c93552e06cd
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically identified as 'Pdf.Phishing.Trojan'. It contains an external URI pointing to a URL that appears to be a lure for downloading a PDF. While no scripts were explicitly extracted, the presence of embedded URLs and the nature of the detection suggest a phishing or trojan distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cructi.ru/pbw?utm_term=personality+theories+workbook+5th+edition+pdf
    • https://static.s123-cdn-static.com/uploads/4462976/normal_5fce87d7e2753.pdf
    • https://static.s123-cdn-static.com/uploads/4475203/normal_5fe01b9427d01.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://wuxikadafi.pbworks.com/f/reading_plus_level_k_answers_silver_wings.pdf
    • https://uploads.strikinglycdn.com/files/47159d56-1ce9-4426-98d0-289da5c274a5/16465764727.pdf
    • http://mosijiv.pbworks.com/w/file/fetch/144424395/59086096726.pdf
    • http://mumubib.pbworks.com/w/file/fetch/144414021/10709649390.pdf
    • http://lugozamuxika.pbworks.com/w/file/fetch/144415551/40317457060.pdf
    • http://ravowibosu.pbworks.com/f/how_to_install_wire_free_ring_video_doorbell.pdf
    • https://uploads.strikinglycdn.com/files/276e60f0-417d-4e0a-be6b-d4091fa6c0d7/why_is_my_lg_ice_maker_not_dumping_ice.pdf
    • http://zexowisam.pbworks.com/f/is_r6_insulation_worth_it.pdf
    • http://poforezufovu.pbworks.com/w/file/fetch/144456540/grammar_active-voice_verbs_and_passive-voice_verbs_quizlet.pdf
    • http://pukagij.pbworks.com/w/file/fetch/144467478/96887701167.pdf
    • https://uploads.strikinglycdn.com/files/399de28a-ef74-4ac0-af1b-855aa1083ef0/83322618464.pdf
    • http://pimepovume.pbworks.com/f/fox_mecanica_dos_fluidos_download.pdf
    • https://uploads.strikinglycdn.com/files/bb5ea067-a86d-4cd2-ba45-782fd3681793/kenmore_sewing_machine_model_385_year.pdf
    • http://zizovitunex.pbworks.com/f/narendra_awasthi_chemistry_book_class_11.pdf
    • https://uploads.strikinglycdn.com/files/1955b8c4-2afc-4b15-b0a2-e7d203815e9e/what_does_getting_a_dress_down_mean.pdf
    • https://uploads.strikinglycdn.com/files/16efcba1-c001-4782-ac2a-54c732974c9e/jusozotadibegibepuvafefe.pdf
    • http://joxupakager.pbworks.com/f/wimaverepaz.pdf
    • http://paderukut.pbworks.com/w/file/fetch/144467361/coleman_powermate_6250_repair_manual.pdf
    • https://uploads.strikinglycdn.com/files/44ee8511-cb3f-4637-bded-084d603eb782/what_careers_make_6_figures_a_year.pdf
    • http://barumena.pbworks.com/w/file/fetch/144452829/how_to_write_a_covid_19_safety_plan.pdf
    • https://uploads.strikinglycdn.com/files/39e20f83-85dc-4495-a2d3-9911e939aff8/mojidenifuzimokomijejota.pdf
    • http://nunaruribeg.pbworks.com/w/file/fetch/144416148/cash_flow_diagram_template_excel.pdf
    • https://uploads.strikinglycdn.com/files/a13c7148-7a5f-44b1-9cae-94846c709962/vefaxuledojiwakun.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e569.bin
677047b1a247a18c14cee055a65fb205ec66a747e1313012087e62e01bfeffc6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE569 5652 bytes
font_01_sfnt_off0000f8b7.bin
7d321637473d6b34148df91f19124e0ca80b370b9ae77b0b4d9521312e11cfc4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF8B7 10788 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.