Malicious PDF — malware analysis report

Static analysis result for SHA-256 91213b3a3a0746e2…

MALICIOUS

PDF

81.7 KB Created: 2021-03-08 21:13:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-04
MD5: e78fe8decf5030542d5db613fa927abe SHA-1: 5b43d20584e2c63e3b13fbc09ce8eb661b4b8458 SHA-256: 91213b3a3a0746e2b7ae328e5faccd494fa7b71ea32a3af8174e1f0109b634db
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains an embedded URL pointing to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The document body, though heavily obfuscated, suggests a lure related to 'English vocabulary with meaning in punjabi pdf'. The presence of an external URI firing further supports the malicious intent of directing users to a potentially harmful website.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/award?keyword=english+vocabulary+with+meaning+in+punjabi+pdf PDF link annotation
    • https://cdn.sqhk.co/rupomotiz/genjh3M/66743477455.pdfIn PDF document text
    • http://idealica-ufficiale.site/popping_boba_fur_bubble_teaam2dz.pdfIn PDF document text
    • https://cdn.sqhk.co/madufuxenuw/Zhbtzhc/frostborn_coop_survival_discord.pdfIn PDF document text
    • http://selowopax.22web.org/kawuruxilagemu.pdfIn PDF document text
    • http://salukapebuke.iblogger.org/assamese_video_song.pdfIn PDF document text
    • http://strongcreditscore.info/why_is_my_calculator_in_scientific_notationzc6iz.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://uploads.strikinglycdn.com/files/8b236017-9aea-49fe-a79c-d2c864d2e1ab/loziworobozimewilix.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/53b903dd-1f19-4325-9e4c-e3233f541d66/hbs_760_price.pdfIn PDF document text
    • https://s3.amazonaws.com/mexesazaxasa/xuxababoledekifuwaripiwif.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/45139422-2753-404e-ba62-866f8bb1cdff/ubiquiti_bullet_m2_hp_manual.pdfIn PDF document text
    • http://jenesigafepi.epizy.com/sesukijovimowulojalo.pdfIn PDF document text
    • https://s3.amazonaws.com/vonutavekip/english_grammar_practice_for_beginners.pdfIn PDF document text
    • http://foweroboxufafuv.epizy.com/optiplex_780_drivers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3f46555d-c623-4818-b2c3-cf0b3beff95e/chinese_dirt_bike_parts_near_me.pdfIn PDF document text
    • https://s3.amazonaws.com/wikurixobelu/breakdown_lane_full_movie.pdfIn PDF document text
    • https://s3.amazonaws.com/rebomedug/lakoduzuvoris.pdfIn PDF document text
    • https://s3.amazonaws.com/zunewidimem/89342538558.pdfIn PDF document text
    • https://s3.amazonaws.com/rebesudanolo/steel_structure_design_calculation_report.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e24d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE24D 5996 bytes
SHA-256: 02f9c489188cc64ef4a2307d8edc2d652460f0518d2752d9897b3bb1d8f93dea
font_01_sfnt_off0000f6af.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF6AF 8988 bytes
SHA-256: 11ce1847abe9854b35aec6ccf857ede450951e53e73763e3ab01cecee4402358
font_02_sfnt_off0001134a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1134A 11304 bytes
SHA-256: 516680078bcaee170ed97236ed124169852df462d4458077f64dee1547ae9515

Open this report in the interactive analyzer, or submit your own file for analysis.