Malicious PDF — malware analysis report

Static analysis result for SHA-256 93bf12dadf9c80cc…

MALICIOUS

PDF

78.3 KB Created: 2021-04-05 15:37:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 28ea3839744e49e007b6990a1a414fbd SHA-1: 97949c2c5177a7a32512f785a79feea33b2e24a9 SHA-256: 93bf12dadf9c80cce24b6cdd65d5d5c1adcb5f918e40dd0e1fc6b8c901628ce1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. An external URI pointing to 'midufefew.ru' was extracted, suggesting a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains metadata related to 'wkhtmltopdf' and a keyword search term, likely part of a lure to entice users to download the file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=makalah+budaya+organisasi+pdf
    • https://cdn-cms.f-static.net/uploads/4417040/normal_60555bddd088b.pdf
    • https://cdn-cms.f-static.net/uploads/4375075/normal_60183e02a368b.pdf
    • http://dinewegivogofe.mygamesonline.org/44888528246.pdf
    • http://mobufuwiwid.medianewsonline.com/31703438080.pdf
    • https://cdn-cms.f-static.net/uploads/4410983/normal_6016c1f12fbe6.pdf
    • http://kuzososo.mygamesonline.org/18039787403.pdf
    • https://static.s123-cdn-static.com/uploads/4495973/normal_6006d8e5624f0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/5655cf9b-5ca4-4288-b6f7-bbbbe5cadd0c/is_outlander_available_on_amazon_prime_canada.pdf
    • https://s3.amazonaws.com/pezofut/music_collaboration_agreement.pdf
    • http://luvetux.myartsonline.com/fesegalunizokuvarexij.pdf
    • https://uploads.strikinglycdn.com/files/c327e768-ecf9-4f7a-8329-b97e4862ae5b/the_chronicles_of_narnia_3_full_movie_watch_online_in_hindi.pdf
    • https://uploads.strikinglycdn.com/files/1461f096-fa9d-4c55-94d5-cd70a796b2b8/best_indian_mythology_fiction_books.pdf
    • https://s3.amazonaws.com/xakusineba/what_is_the_difference_between_new_imperialism_and_old_imperialism.pdf
    • https://uploads.strikinglycdn.com/files/cc878178-b1e9-4c1e-b97b-60caf4bcc8b7/australian_business_law_textbooks.pdf
    • http://jofikuv.atwebpages.com/11329244443.pdf
    • https://s3.amazonaws.com/bokelur/95397962253.pdf
    • https://s3.amazonaws.com/zunaporam/former_rain_and_latter_rain_in_israel.pdf
    • https://s3.amazonaws.com/bitajemisajoz/56459431782.pdf
    • https://uploads.strikinglycdn.com/files/243ca753-016b-4769-b3f6-9e85a91baabf/finevobitovujinasememasag.pdf
    • https://s3.amazonaws.com/galinikagopit/vekoje.pdf
    • https://s3.amazonaws.com/pigolo/muwarovetuwaropup.pdf
    • https://uploads.strikinglycdn.com/files/85bb4a6a-ab37-464d-9a15-e0d41827728d/lenovo_g50-45_ram_upgrade.pdf
    • https://s3.amazonaws.com/dutimajizowa/report_fault_telephone_line_virgin_media.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f5df.bin
4f6e677aabc58ea05362be2f65702f07749024fa3a4d340b806b153f7bd30640		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF5DF 5616 bytes
font_01_sfnt_off000108ff.bin
741f38fe453db5ba94585069ec4a12aa2b74804939bef84265e3479461195158		 pdf-font-stream PDF embedded font (sfnt) at offset 0x108FF 10252 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.