Malicious PDF — malware analysis report

Static analysis result for SHA-256 922c34e4118203da…

MALICIOUS

PDF

78.8 KB Created: 2021-03-18 09:43:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d003f81d0b2b8a3f2aeaac1529b21b14 SHA-1: a26e7510567796247876f12e0cce4c990f459f47 SHA-256: 922c34e4118203daed4b3c7fd2890408a28bd1c7468ecbca25cc0f526f5f9a4c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'maypoin.ru', which is likely used to redirect the user to a phishing or malware distribution site. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, suggesting it might be a generated document used as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=age+of+war+unblocked+games+76
    • http://tasiperop.medianewsonline.com/86873969711.pdf
    • http://gevenukodujojov.getenjoyment.net/lasopusemisimuned.pdf
    • http://mujododaziwato.scienceontheweb.net/basic_music_arrangement.pdf
    • http://memimusisat.getenjoyment.net/bacterial_diseases_in_animals.pdf
    • https://cdn.sqhk.co/migiwepi/ehfjegh/bizafowapogekonufibokolud.pdf
    • https://tiwavejesuma.weebly.com/uploads/1/3/2/6/132681866/nebokijesivixone.pdf
    • http://ribadubeko.scienceontheweb.net/ap_calculus_limits_review.pdf
    • http://mizizufiku.mywebcommunity.org/what_sd_card_best_for_gopro.pdf
    • http://linefofaxugedu.mywebcommunity.org/how_dr_myles_munroe_died.pdf
    • http://fawaxifiwuzodil.scienceontheweb.net/nimugugovitonix.pdf
    • https://zojubexetiw.weebly.com/uploads/1/3/5/3/135316795/abb90507.pdf
    • http://ruwufuwetoj.mygamesonline.org/gilunikajotibiv.pdf
    • https://cdn.sqhk.co/navimoxa/cjfTjgh/bupot.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://xefiposokupama.myartsonline.com/capture_one_12_tutorial.pdf
    • https://58960a86-a3f4-42d8-866e-ee2cf32068b1.filesusr.com/ugd/1ad962_6f38e645fe644d69bebb490facd7a87d.pdf?index=true
    • http://samajusinifako.atwebpages.com/59327254517.pdf
    • http://pabotojixupi.atwebpages.com/antigona_srpski.pdf
    • https://f3b8d348-8566-49c9-a9f8-a2c3b9e1bc8e.filesusr.com/ugd/f1c748_fbfb6cbe926f4d22baead18a42857b8b.pdf?index=true
    • https://b9ecad59-ee1c-469f-8402-ddbad3bf215f.filesusr.com/ugd/84dab8_32803ff9f835458382888d4afa351c12.pdf?index=true
    • https://3bcdeb60-9876-4d14-bc0a-1dd1632c647c.filesusr.com/ugd/16a96a_f2c940fcc3c24b4d826338f0b07f931a.pdf?index=true
    • https://ea64ff4c-51e6-4efc-8cc1-399682447901.filesusr.com/ugd/961f18_258b78e72ae64fa9b6725f0adb69085b.pdf?index=true
    • https://sites.google.com/site/unblockedgamesbolich/portal-2
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000df36.bin
001be0785c5d40d8fc58cf8a2228b66a9d7bf0e60af81b0b65060cae20efd79c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDF36 5860 bytes
font_01_sfnt_off0000f339.bin
adc28a0daea082eb5c9cfd2c8de52d726ff869de517182d6f0620faa22d90953		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF339 10872 bytes
font_02_sfnt_off00011886.bin
c988415812f594187b0a0ed75dc52802e798e1695b49bd300f8412a65040a449		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11886 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.