Malicious PDF — malware analysis report

Static analysis result for SHA-256 905476c76c2848f2…

MALICIOUS

PDF

80.4 KB Created: 2021-04-16 13:21:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 81f0c7d117abe2988cc4b611cababdb3 SHA-1: 5e66c5667933ce129b3e32f4a2d39529dc588841 SHA-256: 905476c76c2848f22b2058fbd04992adbdf43f3c6ea504ea98f13f6188042199
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The document contains an embedded URI pointing to a suspicious URL, which is likely part of a phishing or malware distribution scheme. Although no scripts were extracted, the presence of the malicious URI and the overall classification strongly suggest a phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=what+time+does+the+stock+market+open+today+in+texas
    • http://pexulisinipev.sportsontheweb.net/8th_grade_social_studies_practice_test.pdf
    • http://rebezun.mygamesonline.org/kitchenaid_stand_mixer_tilt_5_quart_rrk150wh_artisan_tilt_white.pdf
    • https://cdn.sqhk.co/pelopuxi/njhahhG/airthings_wave_plus_factory_reset.pdf
    • https://cdn.sqhk.co/vedasukuki/smFjbhg/extinction_definition_ecology.pdf
    • http://winatesef.sportsontheweb.net/ielts_academic_writing_task_1_sample.pdf
    • https://cdn.sqhk.co/tosijoxopum/egcgfMZ/pijezijekanep.pdf
    • http://fumumowovufa.mywebcommunity.org/giman.pdf
    • http://kadaxejob.mypressonline.com/adobe_reader_apk_free.pdf
    • http://wofirulufe.iblogger.org/author_s_point_of_view_printable_worksheets.pdf
    • http://sewawena.scienceontheweb.net/80953752858.pdf
    • http://kelirajisob.66ghz.com/93519423426.pdf
    • http://lulopoboxefon.scienceontheweb.net/batejagemagovu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://nadovudeduxawos.rf.gd/assault_cube_hack.pdf
    • https://d38713d8-f9e0-49bf-8e72-3f46774ce551.filesusr.com/ugd/b3faf5_79d419d818d34c4db9da2bb9a91e68a7.pdf?index=true
    • http://nozanela.epizy.com/1548303324.pdf
    • https://s3.amazonaws.com/kulinisokakewi/40887796208.pdf
    • https://s3.amazonaws.com/tokatefozude/firefox_bookmarks_app_for_android.pdf
    • https://a161ff94-1a6f-4367-b6f8-8e513a5e676d.filesusr.com/ugd/4c7633_ab8a613cf98c4d0693f91ce1a827476f.pdf?index=true
    • https://s3.amazonaws.com/lovetijif/41493849845.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f8b8.bin
12c88952a90f1b085b23721459f83e400fc619a0004055e6bdd8ddb3cd1b71b9
pdf-font-stream PDF embedded font (sfnt) at offset 0xF8B8 5528 bytes
font_01_sfnt_off00010b6c.bin
1ba40f99c317a30265a4e869813a8724d5834ca85e4dd1f0ff8a7fa903517edc
pdf-font-stream PDF embedded font (sfnt) at offset 0x10B6C 11240 bytes