Malicious PDF — malware analysis report

Static analysis result for SHA-256 90fecbba12d45ae3…

MALICIOUS

PDF

81.8 KB Created: 2021-03-08 23:55:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d9ce3fa07616e09c9868a03b45dd6c19 SHA-1: d5c6f8e44830774948163af2f22756637774ab94 SHA-256: 90fecbba12d45ae3648b159f2671c3251248120b7f4084d524d5f03364810774
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic indicating an external URI, which points to a suspicious domain. The ML classifier and ClamAV detection strongly suggest malicious intent, likely a phishing attempt disguised as an installation guide to redirect users to a malicious site. No scripts were extracted, but the presence of an external URI is a primary indicator of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=deepin+os+installation+guide
    • https://cdn-cms.f-static.net/uploads/4530171/normal_6044f48001089.pdf
    • https://cdn.sqhk.co/xobupiba/GgejdMH/darkness_rises_leveling_guide_2020.pdf
    • https://cdn.sqhk.co/dasadogiso/ig7MKhb/prince_of_peace_catholic_church_flowery_branch_bulletin.pdf
    • http://instasale.company/frontline_commando_d_day_apk_modbah36.pdf
    • https://cdn.sqhk.co/doginifa/h4FaMtS/liwubeme.pdf
    • https://cdn-cms.f-static.net/uploads/4391636/normal_60329eba15e0d.pdf
    • https://cdn.sqhk.co/nujekezitifi/jbjh3gh/46691623687.pdf
    • https://cdn.sqhk.co/nemalerute/AZifhe4/mini_games_for_pc_windows_7_free_download.pdf
    • http://xagugudel.sportsontheweb.net/how_to_play_2_player_on_goat_simulator_ps4.pdf
    • http://mon-cmbretagne.com/gtn_725_750_tso_installation_manualzrxxz.pdf
    • https://cdn-cms.f-static.net/uploads/4422909/normal_6018ce76c07fa.pdf
    • http://xojuxelase.medianewsonline.com/89793597444.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/fbc2f562-0dcf-4a57-bf55-11b3f1023694/an_introduction_to_language_11th_edition_free.pdf
    • https://uploads.strikinglycdn.com/files/8c5480bc-727e-49fa-a383-6ffd7eb44b4f/modufexidinilorimabilo.pdf
    • https://uploads.strikinglycdn.com/files/8b5c8ca4-f2cd-4d55-996b-423c49f9bf6e/britax_roundabout_55_manual.pdf
    • https://uploads.strikinglycdn.com/files/b6755646-b636-4360-8e29-4a96a2557f77/how_to_apply_large_vinyl_window_decals.pdf
    • https://uploads.strikinglycdn.com/files/5c48e691-a3c6-47e4-aad1-4b9dbd08a1b5/where_can_i_get_a_replacement_charger_for_my_fitbit.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f035.bin
e93c4026087cca1c87d33583087bfdd9d02772df090852f8e8ec26b72f5efaff		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF035 5032 bytes
font_01_sfnt_off0001016a.bin
2928bcd30ea912f91b3b835f9832d376b47e68f7da0b66f13884dec1b0bb7a9f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1016A 10136 bytes
font_02_sfnt_off00012474.bin
fc8e76084f6700382cfeeb812ba548e5b7ad2d6d986dd969901d024b851cbd43		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12474 16200 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.