Malicious PDF — malware analysis report

Static analysis result for SHA-256 922596f522e6d0a6…

MALICIOUS

PDF

102.3 KB Created: 2020-11-20 08:51:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31
MD5: ba6fe2b33ae7430fa7f658afb6d0e3bb SHA-1: 799b1edd0b7e60ad38f765bfac9fdf91d5d34941 SHA-256: 922596f522e6d0a62ff2f71cee844d2c9b6efa57d650da60ed09a091ac83e79d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing an embedded URI that points to a suspicious domain, identified by ClamAV and a machine learning classifier as malicious. The document body, though heavily obfuscated, contains text that appears to be a lure related to 'Toy Story'. The presence of an external URI suggests an attempt to redirect the user to a potentially malicious site for phishing or further payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/123?utm_term=toy+story+ytp+clean PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/zunaduxa/nejudikazeramupi.pdfIn PDF document text
    • https://s3.amazonaws.com/jimugivos/bgp_interview_questions_and_answers_for_ccie.pdfIn PDF document text
    • https://s3.amazonaws.com/resixexi/le_pass_compos_avec_tre_et_avoir.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/18a24732-a22b-46e8-b3d9-1bbb503d3a64/8705415256.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6cae442e-44a8-484b-ab88-a94f3ccb34b9/gavopazilimilora.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8eb9a2d4-9363-4f45-928f-d4b1661375b6/wezitoxenamofijox.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/74582044-54ce-46ce-b41e-1f3e2ea04dd6/feguxi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5728c864-43ec-4fb7-bd3c-4530ad00e3c5/66615758562.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/df1e509f-f45e-4da0-a798-e9ab68d8df3b/peziwupetonikogaxojeberu.pdfIn PDF document text
    • https://s3.amazonaws.com/desenaz/2276952259.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f2170f29-fa35-417d-82a2-ebc54f239e69/42756078698.pdfIn PDF document text
    • https://s3.amazonaws.com/nefomojuwet/40751371612.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bc7d7f21-8e65-4c8e-9055-9f2f12b8707c/99108653014.pdfIn PDF document text
    • https://s3.amazonaws.com/zazelujeju/79059499527.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00014638.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14638 4720 bytes
SHA-256: 6d077c099184eb8e4822ee29ccd1f858c4299bb567e1b978dfe22675c3e19761
font_01_sfnt_off00015652.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15652 12292 bytes
SHA-256: 1eca8caa77c59424794f61378c1c3bc3e2334aa2a9fdca8d9abb42cf88b7a043
font_02_sfnt_off00017e0c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17E0C 4324 bytes
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e

Open this report in the interactive analyzer, or submit your own file for analysis.