Malicious PDF — malware analysis report

Static analysis result for SHA-256 92a37bcd82abdc82…

MALICIOUS

PDF

82.0 KB Created: 2021-03-24 12:33:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d9f1494f5e967ab563b968f1bac021bf SHA-1: 1d90e2a61d698ab97be1e729d8b2ccddf9e49376 SHA-256: 92a37bcd82abdc822c15c3fe6bb391d86b15c526da2798f2e11afc65e7b30ed3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely intended to host a malicious payload or redirect the user to a phishing site. The document body, though heavily obfuscated, contains text related to 'binding the strongman' and the wkhtmltopdf tool, suggesting a lure to disguise the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=binding+the+strongman+pdf
    • https://cdn-cms.f-static.net/uploads/4370307/normal_601d5fa14a87a.pdf
    • https://cdn-cms.f-static.net/uploads/4389355/normal_6015294c592f1.pdf
    • https://cdn-cms.f-static.net/uploads/4490252/normal_5fd87ca3a7bae.pdf
    • https://cdn-cms.f-static.net/uploads/4483839/normal_605032f07941a.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://tewaremiluzavag.rf.gd/98770046441.pdf
    • http://garafukaralefa.epizy.com/the_top_five_regrets_of_the_dying_free.pdf
    • http://titasukutisun.epizy.com/criminal_law_nsw_book.pdf
    • https://s3.amazonaws.com/wutezigojuxi/balu_mahi_movie_video_song.pdf
    • https://uploads.strikinglycdn.com/files/518a3f88-7eb0-476c-85f2-eff1f153fdcd/blheli_esc_manual.pdf
    • http://lavodusepigixu.rf.gd/brazilian_portuguese_beginners.pdf
    • https://uploads.strikinglycdn.com/files/e5aa2b20-c882-4e0a-ba59-5946e5a9368a/45209864729.pdf
    • http://wozubegozib.rf.gd/37906922370.pdf
    • https://uploads.strikinglycdn.com/files/3daeb9c0-0157-4e9a-9fb1-1b4c28af0785/wildgame_innovations_terra_extreme_10_reviews.pdf
    • https://uploads.strikinglycdn.com/files/89261d43-b8be-403e-9c15-a69157da920b/lolagonitawijexoveti.pdf
    • https://uploads.strikinglycdn.com/files/1f8bfbef-c617-428b-973a-7ec2479951e8/19858426512.pdf
    • https://uploads.strikinglycdn.com/files/6d742021-f8d6-4108-a0c5-fdf63d5fe76c/notesevopusop.pdf
    • https://s3.amazonaws.com/xebuvuwov/lofisomerivajubexotu.pdf
    • https://s3.amazonaws.com/patotale/12684262548.pdf
    • https://s3.amazonaws.com/pekatikisuruki/demand_driven_material_requirements_planning_ddmrp.pdf
    • https://uploads.strikinglycdn.com/files/805e5e5b-262b-4442-a2ba-c9043e76b6ee/44498235268.pdf
    • http://jumebesatupa.epizy.com/jeux_interdits_piano_sheet_music_free.pdf
    • https://uploads.strikinglycdn.com/files/fd4dd200-e541-4ff7-acf5-94963de38c7b/lodinolodavozakazof.pdf
    • https://uploads.strikinglycdn.com/files/bd2a815f-662d-4728-af74-ae0afb899a60/zitutije.pdf
    • http://nemagigorame.epizy.com/jegavab.pdf
    • http://xenemusexo.epizy.com/marriage_certificate_form_maharashtra.pdf
    • https://uploads.strikinglycdn.com/files/b72b587f-5eb5-4da5-bb50-a33e1c3e3e26/lenovo_thinkpad_t430_reset_bios_password.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001027b.bin
31f51af361fb8ee7cbeb17071d14b3a5277c45238af5a789393705f41de204c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1027B 5472 bytes
font_01_sfnt_off000114f3.bin
de305bbdf01af20ee47ca07de893f12c9ac075acfa2ddd3f9ac43d8a46aec157		 pdf-font-stream PDF embedded font (sfnt) at offset 0x114F3 11532 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.