Malicious PDF — malware analysis report

Static analysis result for SHA-256 94ca47deff7711a8…

MALICIOUS

PDF

160.7 KB Created: 2021-03-24 20:40:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3ff834e1f371b5392a3036448a189fa8 SHA-1: 48c328f0f8b5db619c04281bcb1d2ececd6f0f1e SHA-256: 94ca47deff7711a8e092152e146d33774429a93d4d164ad8e137a01058d8bc3d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that redirects to a suspicious domain, disguised as a search result for 'akbar birbal stories in marathi pdf'. This URL is likely intended to lead the user to a malicious site or download further malware. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9986

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/123?utm_term=akbar+birbal+stories+in+marathi+pdf
    • http://fuxanujibiz.mygamesonline.org/how_well_does_verizon_hotspot_work.pdf
    • http://meetchat.space/sistema_muscular_humano_powerpointr70ms.pdf
    • http://cardioactiveuficiale.site/vevivovegeruvf7e8d.pdf
    • http://exampl1214.com/normal_distribution_table_z0.05a93bb.pdf
    • http://wekeb.space/progression_daccords_piano_gospel77hmo.pdf
    • http://logawedulukudan.mywebcommunity.org/3391371523.pdf
    • http://net-klientov.ru/vovijerorinuwizuxeuepl1.pdf
    • https://cdn.sqhk.co/pelopuxi/mYjjbsP/mixuwolexuzasorivukibaja.pdf
    • http://lazategomid.scienceontheweb.net/cable_tray_installation_guidelines.pdf
    • http://levantegroup.net/goxenedulebawijaxavofikuob1fg.pdf
    • http://boraguw.medianewsonline.com/peter_pan_storybook.pdf
    • http://tesar-krd.ru/earth_day_acrostic_poems_answers1bhaf.pdf
    • http://jonebukusopovet.mygamesonline.org/asme_b31_8_espaol.pdf
    • https://cdn.sqhk.co/jegisizozul/nLjbgiM/jitiwojuf.pdf
    • http://operationhomeplate.com/zusugilelolinl57xb.pdf
    • http://fedorahosted.org/lohit
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://rususekobijo.myartsonline.com/dotajisogisorudesagif.pdf
    • http://sadoboxijowem.myartsonline.com/ecocardiograma_transtorcico.pdf
    • https://s3.amazonaws.com/xedewofuretujo/wow_demon_hunter_8._2_guide.pdf
    • https://s3.amazonaws.com/zomuzigo/gukurara.pdf
    • http://pajupevezujugut.atwebpages.com/dainik_bhaskar_epaper_bhopal.pdf
    • https://s3.amazonaws.com/bepukuba/why_does_my_marlin_model_60_jam.pdf
    • https://s3.amazonaws.com/bizamesuwepe/free_printable_science_worksheets_for_elementary_students.pdf
    • https://s3.amazonaws.com/pusolefosex/69076270653.pdf
    • http://binuwuzipu.myartsonline.com/98567602330.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00022881.bin
e50255ec882a91577cc36b775efc557b2866429f3a369bfea6b115b7b9d5f2ab		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x22881 26652 bytes
font_00_sfnt_off0001eb72.bin
4d3edd0da778ff03b36d483c94d0481fed9da9b279ad5854d74ef11d60128225		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1EB72 5472 bytes
font_01_sfnt_off0001fde3.bin
c7b4b7463f669da905afebae9ec7e1d6db1759e3540f4f3912f67c21c79e7b4e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1FDE3 15520 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.