Malicious PDF — malware analysis report

Static analysis result for SHA-256 8ef07e760185fe3f…

MALICIOUS

PDF

158.8 KB Created: 2021-03-28 04:10:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 760c5b6d188c4ab26db569aea0a57458 SHA-1: d8bfca344cd922e62cc0662a2d678951a81d6417 SHA-256: 8ef07e760185fe3fe04dd5b5cc476275f23f01af407b6debff08100ac1a51751
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, pelibifir.ru, which is likely used to host a phishing page or download further malware. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, suggesting it was generated programmatically to appear as a benign document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/award?keyword=prefixes+and+suffixes+games+pdf
    • https://labekefetimobu.weebly.com/uploads/1/3/0/7/130739294/nirer.pdf
    • https://foxazejepanobo.weebly.com/uploads/1/3/1/6/131637169/lufasigibafefiw.pdf
    • http://jeruxawi.iblogger.org/calendar_design_software_free.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://a5fc3680-5c08-4cda-bd6c-abaa3bdf25bc.filesusr.com/ugd/ea5d7b_f98f7a7bbd3849cd95d264680c92ef1f.pdf?index=true
    • https://s3.amazonaws.com/vokeri/rubapomerekanen.pdf
    • http://pejabefi.rf.gd/26395079123.pdf
    • http://potimafekun.epizy.com/knowing_god_bible_study.pdf
    • https://0b670cc3-d94b-4117-8b98-7ce677fb6c21.filesusr.com/ugd/7bc559_b66750e3ba894925922ae4234cdf5980.pdf?index=true
    • https://s3.amazonaws.com/rawesaragegugar/gift_box_template_with_lid.pdf
    • https://s3.amazonaws.com/boduxatavepe/78106087575.pdf
    • https://d1897088-ef6e-4b60-8303-910b4b551fc1.filesusr.com/ugd/4cfbbd_fd1f09582e194e9cbf63a7d582a4d61a.pdf?index=true
    • https://s3.amazonaws.com/gupojakami/4400_mm_to_m.pdf
    • https://3d5b2cfc-74f5-4c02-8466-0d369b02955c.filesusr.com/ugd/69b86f_e967c6ae2d03419b9a22cc91c6fd9e6e.pdf?index=true
    • https://c1908cc8-b41e-4b5b-ab1c-53d28a7f2745.filesusr.com/ugd/913720_5f19469b7235493aae91e18df773f1bd.pdf?index=true
    • https://uploads.strikinglycdn.com/files/aecd5aa2-7e9e-4d20-aec8-3e11abae9d4e/26878587431.pdf
    • https://uploads.strikinglycdn.com/files/b4aacc7a-6806-448a-a664-8ed61e2254fa/what_is_the_structure_of_annabel_lee.pdf
    • https://61249681-e2d1-4375-841a-b3723294d79c.filesusr.com/ugd/3d514e_d12a5e98b90a4a428ee64372778b5105.pdf?index=true
    • https://uploads.strikinglycdn.com/files/154e32c0-4d84-427a-ad4d-94da6999a06b/11259779299.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de04.bin
cee987058e7b51e5ea3ef81b432c1ac2dcf0e6f3a6219545f749131cbf79a0a5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDE04 115924 bytes
font_01_sfnt_off00023873.bin
db759c8e0c35d78a437aa782f5c90d204c52220e50ca79daed76c69bdc286f10		 pdf-font-stream PDF embedded font (sfnt) at offset 0x23873 5396 bytes
font_02_sfnt_off00024ac1.bin
7f1b8b8f59be24a768fdca18759021f1ebb85373dc28e4409ae090cc8efac7af		 pdf-font-stream PDF embedded font (sfnt) at offset 0x24AC1 9860 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.