Malicious PDF — malware analysis report

Static analysis result for SHA-256 903fbad91c7cf39e…

MALICIOUS

PDF

97.6 KB Created: 2021-03-08 01:23:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: eb08bcb167ca865137dec36831104489 SHA-1: dd32c2bff79968f95e3e2cafc894e2a50b32275b SHA-256: 903fbad91c7cf39e05d1b3e45c67d2bf6cde894f870bd3a20f8838cf4cbffb57
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. The document contains an embedded URL that leads to a suspicious domain, likely intended to host a phishing page or further malware. No scripts were extracted, but the PDF structure and embedded URI heuristic suggest an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=what+does+a+bold+person+mean
    • https://cdn.sqhk.co/josurowelimu/dH8cijh/fejukuguzoz.pdf
    • https://cdn.sqhk.co/gimexigerub/iqdKMjh/f_sim_space_shuttle_mod_apk_android_1.pdf
    • https://cdn.sqhk.co/suxavawudomo/W4hfjfS/snake_in_toilet_bowl_dream.pdf
    • https://cdn.sqhk.co/vomawoko/Lheibgd/free_screen_recorder_online_no_watermark.pdf
    • https://cdn.sqhk.co/tofigidukug/arZ3pA0/72906737324.pdf
    • http://sutovuresas.mygamesonline.org/figenugerira.pdf
    • https://cdn.sqhk.co/fenogate/dggifie/man_running_from_cheetah_full_video.pdf
    • http://kamikofonem.mygamesonline.org/tccl_hd_set_top_box_usb_video_format.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.opentle.org
    • https://s3.amazonaws.com/fizaxo/what_are_the_examples_of_derivation.pdf
    • https://s3.amazonaws.com/pigolo/what_to_wear_to_a_daytime_catholic_wedding.pdf
    • https://s3.amazonaws.com/jukoxisojow/12778106654.pdf
    • https://s3.amazonaws.com/dalava/lijawixadafazenaxepeme.pdf
    • https://s3.amazonaws.com/bevarolimesale/likufeku.pdf
    • https://s3.amazonaws.com/sefepugolupalax/mevawaziwetide.pdf
    • https://s3.amazonaws.com/bulozor/zufubuwewirewamuxikiweman.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://www.gnu.org/licenses/gpl.html
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f14e.bin
08a9a70a3e88dfe3e25a863acd776b35cf7e0cd48ba3c170efa2827d575c6fbf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF14E 7572 bytes
font_01_sfnt_off00010ad8.bin
b9c43c073210091fa8bfed696763bb8b7072812b74275630a0207815c44a7af9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10AD8 5352 bytes
font_02_sfnt_off00011cd7.bin
7fa6e24730c120063272213dd24c3fad2377e594b8e85c57c5a1142af5275178		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11CD7 8196 bytes
font_03_sfnt_off00013329.bin
1a4f35f656fb22a28c632ed5b2eaa76d5e6198e772f2f18824a0f1851768597e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13329 13512 bytes
font_04_sfnt_off00015caf.bin
3e2a90eb78517e3d27b0148db6c0c8b4edf8edea4d26de99843998a54413e2a8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15CAF 17708 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.