Malicious PDF — malware analysis report

Static analysis result for SHA-256 9405d9f5b149dc26…

MALICIOUS

PDF

75.2 KB Created: 2021-03-23 18:04:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 499b6da0b17aa6a2133e224e49b9b560 SHA-1: 70e9821803acb38545f3d0cf78d1470823b01c8c SHA-256: 9405d9f5b149dc2618ee36e8faf40ce9daa461951d06adbc5600f4662268b8bf
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple embedded URLs, with the primary one being 'https://maypoin.ru/award?keyword=anti+human+trafficking+law+pdf', suggesting a phishing lure related to legal documents or awards. The ML classifier and ClamAV detection strongly indicate malicious intent, likely to deliver a phishing payload or malware. While no scripts were explicitly extracted, the presence of embedded URLs and the nature of the heuristics point towards a phishing attack vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/award?keyword=anti+human+trafficking+law+pdf
    • http://yoganchik.space/construction_europenne_cm2rph1m.pdf
    • https://cdn.sqhk.co/rovukupovumo/aQP6hjn/wilozanukixokusudalomu.pdf
    • https://cdn.sqhk.co/faxonudogot/XjhPhhY/gixibomigiti.pdf
    • http://lifelalulenomip.mygamesonline.org/67860685431.pdf
    • https://cdn.sqhk.co/nozelenid/gPV8GPY/monster_warlord_evolution_guide.pdf
    • http://portkamesto.site/chemistry_a_molecular_approach_4th_edition_freewdexs.pdf
    • https://cdn.sqhk.co/rajexizeba/hchahc3/zijifufavitezumutulijol.pdf
    • http://luxasireku.sportsontheweb.net/wagoregojitod.pdf
    • http://the-job.ru/english_composition_with_essay_clep_practice_test1s46m.pdf
    • http://esparks.ru/barcarolle_chopinaaj5n.pdf
    • http://jerimujolegem.medianewsonline.com/traxxas_summit_1_16_parts.pdf
    • http://1s.london/dadanasuncx9yt.pdf
    • https://cdn.sqhk.co/lijipatalenu/f6kVK6Y/78429050617.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://77701ba7-c5ad-4750-ab17-5b03548f7fc0.filesusr.com/ugd/9a242c_f40632ff519341039f87d2aa63b2d6a5.pdf?index=true
    • https://80c93ba6-74df-4afb-9852-3a83eaba20e3.filesusr.com/ugd/4cf28d_2e7e804ad0c449d58cb3656965be2f0b.pdf?index=true
    • http://wubonaxe.epizy.com/40922921339.pdf
    • http://duzujijola.epizy.com/somabipaparut.pdf
    • http://buwijakuwomem.rf.gd/lubipegovutavopesumorive.pdf
    • https://uploads.strikinglycdn.com/files/d6be2a05-99f5-4840-82c6-d33dd20c8c0c/laxozifibivakozu.pdf
    • https://69a21580-3c80-4f81-8097-1ec0bc18215d.filesusr.com/ugd/bd7df1_248dea49d859484fb80d280e7b6a8528.pdf?index=true
    • http://xekabotiwuker.atwebpages.com/5998537836.pdf
    • https://uploads.strikinglycdn.com/files/1e9d1e91-a242-4ec7-9b4e-4d2b06e2c5dc/80170741415.pdf
    • https://143c7e3e-1a56-4739-9c24-5aac26b0263b.filesusr.com/ugd/28d7c1_5414d60519714e43a1ecbd62213e1fb2.pdf?index=true
    • https://uploads.strikinglycdn.com/files/189b6813-8696-41ee-be89-5662026f6fbf/alinco_dx-sr8t_price.pdf
    • http://tetutima.rf.gd/vibakozelizinifilutiwo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e896.bin
2de00704f17791f0f907ad04af5b8720e7b3cae0355a892b079b7eeb0462df56		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE896 5536 bytes
font_01_sfnt_off0000fb56.bin
f4b04cfb4bd58106aa30faeaf0a36d97427bc122c8bf3b07ed733962c288a9d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB56 10652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.