Malicious PDF — malware analysis report

Static analysis result for SHA-256 91eb5c206bf1f3d1…

MALICIOUS

PDF

79.7 KB Created: 2021-03-21 08:29:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 164185ddf5da199153bdd41e2ad320b7 SHA-1: d57008d1082f67e0036f1178e0041bcfb9ce923a SHA-256: 91eb5c206bf1f3d1eb32cd6853be34a1e44d0f05e37edbe12565cb9998022934
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. The document body, though heavily obfuscated, appears to be a lure related to a search query, suggesting a social engineering tactic to drive traffic to the malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wix?keyword=is+john+the+baptist+elijah+reincarnated
    • http://italysummer.space/re_admission_form_at_tut_2018hie16.pdf
    • http://bewizasosu.sportsontheweb.net/wajutexapogawabufebazaze.pdf
    • http://pekibexuvipeve.scienceontheweb.net/selenium_webdriver_tutorial_java_download.pdf
    • http://rajukilodagoje.mygamesonline.org/62056603375.pdf
    • http://perevozka.ru/descargar_los_juegos_del_hambre_castellano_megapguqr.pdf
    • http://kismyketio.com/66872954244dza34.pdf
    • http://baboguzaxeleju.mypressonline.com/74030997804.pdf
    • http://wixujikubipom.mygamesonline.org/lejoseketuweludopaxi.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/99085f59-b729-4d8d-bf7c-e7210b95348d/32096941018.pdf
    • https://uploads.strikinglycdn.com/files/b648a95a-b387-4cdc-be45-c463d66e4be4/cuisinart_keurig_coffee_maker_not_pumping_water.pdf
    • https://s3.amazonaws.com/legenapi/how_to_use_poll_everywhere.pdf
    • http://likutolejit.onlinewebshop.net/dufororukelu.pdf
    • https://s3.amazonaws.com/warapagefasovi/45590464678.pdf
    • http://mojozore.myartsonline.com/alpha_amylase_test.pdf
    • https://uploads.strikinglycdn.com/files/8a7bdab0-ab55-462e-87d7-9f8c3a9fa30b/52536254646.pdf
    • https://uploads.strikinglycdn.com/files/62ca4d61-f925-4c10-9d82-8b4b06fa9002/is_grain_free_necessary_for_dogs.pdf
    • https://s3.amazonaws.com/kujesulad/bengali_full_movie_shikari.pdf
    • http://moxuzaridob.onlinewebshop.net/bosque_tropical_humedo.pdf
    • http://pimoxonevuwewax.atwebpages.com/mastering_blockchain_andreas.pdf
    • https://uploads.strikinglycdn.com/files/2bb4dcca-5f40-4e23-9eb5-ef52f4d3adcd/81255258110.pdf
    • https://uploads.strikinglycdn.com/files/7d23817d-9323-4eaf-a025-0f0d8d50e625/final_fantasy_xv_ps4_trophies.pdf
    • https://uploads.strikinglycdn.com/files/6ac9b121-5be0-4ee5-9bf2-322a9fc2a047/15695747173.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f9a2.bin
48cefc0c6167edf8d9320190ff43ff83e25df25fc549ee8e421dbf99f36c393f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9A2 5316 bytes
font_01_sfnt_off00010ba6.bin
6412ead72ab29ae8e65dd4c66d75fd29ddac7aed029cc7634f703d2b4bfe6d5f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10BA6 10992 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.