Malicious PDF — malware analysis report

Static analysis result for SHA-256 8f064fbe8e4883ce…

MALICIOUS

PDF

81.7 KB Created: 2021-04-06 01:36:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ffda38dcbccd6e296b2e9090811b9824 SHA-1: a3deca54df15cedc9e885609e1413747ec5bed69 SHA-256: 8f064fbe8e4883ce7bee415ff7cb72235eb90d9f2f7d0850651b7fa66a7762af
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URI pointing to a suspicious domain, identified by heuristics and a machine learning classifier as malicious. ClamAV also detected it as a phishing trojan. The document body, though heavily obfuscated, appears to be a lure related to a product review, intended to trick users into visiting the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=detrola+record+player+review
    • http://niluwipewuxasa.medianewsonline.com/widimivajajalor.pdf
    • http://tinipen.medianewsonline.com/81246210632.pdf
    • https://cdn-cms.f-static.net/uploads/4489042/normal_6013c9e47a7a6.pdf
    • https://cdn-cms.f-static.net/uploads/4472774/normal_5fd9c066318cd.pdf
    • http://zeraseb.66ghz.com/57223600556.pdf
    • https://cdn-cms.f-static.net/uploads/4470024/normal_6056a75765ae5.pdf
    • http://kulotufiw.mypressonline.com/fundamentals_of_c_language_free_download.pdf
    • http://nokevaxexu.iblogger.org/41728725361.pdf
    • https://cdn-cms.f-static.net/uploads/4411001/normal_60117c27b8da2.pdf
    • https://cdn-cms.f-static.net/uploads/4393790/normal_5fdae0f9c00fd.pdf
    • http://bikokobolo.sportsontheweb.net/burozejibuki.pdf
    • http://pavekaluriwexe.22web.org/panebox.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/gixawetopoli/how_much_does_cortisone_shot_cost.pdf
    • https://s3.amazonaws.com/mawesenasijoser/types_of_mild_steel_sheet.pdf
    • https://s3.amazonaws.com/jitimesolagun/method_man_redman_blackout_2_zip.pdf
    • https://s3.amazonaws.com/vosimalume/gadamozoriluzesaniwedudo.pdf
    • https://s3.amazonaws.com/lopadivupudexa/fotiwofotigaxebut.pdf
    • https://s3.amazonaws.com/webipejonavuv/magnus_chase_and_the_gods_of_asgard_book_4.pdf
    • http://felixoxajaxev.epizy.com/jalomaxobemobinav.pdf
    • http://dudeferurap.epizy.com/zefujevujimepazepexu.pdf
    • https://s3.amazonaws.com/bulikowexunepov/football_flyer_template_free.pdf
    • https://s3.amazonaws.com/kiremefegonar/50514941572.pdf
    • http://sanonusujinuz.rf.gd/raliwuvekenabifuzijaf.pdf
    • http://kavozusuzoluwun.rf.gd/employment_contract_sample_philippines.pdf
    • http://pemeromerap.rf.gd/how_to_make_carpentry_tools_an_illustrated_manual.pdf
    • http://zekafoweratum.epizy.com/watson_behaviorisme.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010263.bin
b5271ecb9ecdae5f400ed95e37ed0541e142bf053f837ee5bb53eb71c2bf2a5a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10263 5140 bytes
font_01_sfnt_off0001140a.bin
c2405a7a7a4775c01c8141f6490b99a0ad45dc28b3b38531bf94599064735f83		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1140A 10960 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.