Malicious PDF — malware analysis report

Static analysis result for SHA-256 95beb5ef53d77626…

MALICIOUS

PDF

74.0 KB Created: 2021-03-12 13:13:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7ecd1fde9442653ccfea404be61c41a4 SHA-1: b737db9b5c570f6cdd25b17f011bb734d7b74024 SHA-256: 95beb5ef53d776264d1e9719a70cec2896fced11cc24e3a1bfd18cdcedcc0491
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. The document contains an embedded URI pointing to a suspicious domain, likely intended to deliver a secondary payload. The presence of PDF-specific heuristics and the overall detection score suggest a phishing or trojan delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/award?keyword=hannah+arendt+biography+pdf
    • https://litukepulaj.weebly.com/uploads/1/3/4/8/134863372/6380359.pdf
    • http://goodsun.space/xafozexobezaruzukedulgf2h.pdf
    • http://wersita.fun/tolumukigupanoxilasejak7c0u.pdf
    • https://midagadin.weebly.com/uploads/1/3/1/3/131381693/887785.pdf
    • http://vutaturubodud.22web.org/poulan_pro_31cc_pole_saw_carburetor_diagram.pdf
    • https://rogujodur.weebly.com/uploads/1/3/4/8/134899240/9562142.pdf
    • https://sebidodeg.weebly.com/uploads/1/3/4/4/134438526/rudaxuxanuzoto.pdf
    • https://fagudigozupubu.weebly.com/uploads/1/3/6/0/136042622/195c6311a.pdf
    • http://winepazijabubov.22web.org/dutuwatenus.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://jiruroxi.epizy.com/john_deere_345_starter_relay.pdf
    • https://s3.amazonaws.com/dezajok/72167132937.pdf
    • https://uploads.strikinglycdn.com/files/0b252297-0bc4-4d5d-9855-66212c883fc2/66523401721.pdf
    • http://sakanaj.rf.gd/farometatexanimapuxulage.pdf
    • https://uploads.strikinglycdn.com/files/1c4c780e-0fa7-4159-8032-c27d2b295470/best_essences_for_marksmanship_hunter.pdf
    • https://uploads.strikinglycdn.com/files/fea64243-9935-49f6-9436-6077798eec99/when_to_enter_a_stock_trade.pdf
    • https://uploads.strikinglycdn.com/files/08deea6a-061b-4225-8ab0-bf38faa81baf/is_breakfast_at_tiffanys_based_on_a_book.pdf
    • https://uploads.strikinglycdn.com/files/e4bb0d17-60da-4590-8c35-67d872385085/61750628976.pdf
    • https://s3.amazonaws.com/sobaketemu/how_to_use_a_scunci_steamer.pdf
    • https://uploads.strikinglycdn.com/files/06ad7e57-8c8a-4f7f-9ccd-df88c8ad7f69/85446423503.pdf
    • https://s3.amazonaws.com/kefiperizonofu/article_of_association_of_a_company.pdf
    • http://zikepodaw.epizy.com/742164643.pdf
    • https://s3.amazonaws.com/jedadokuti/comienzan_las_reformas_borbonicas_en_nueva_espaa.pdf
    • https://s3.amazonaws.com/wupixufekijax/29028399928.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e5e6.bin
2af8ca0c1a3da8190b40aebbfbcc5b05992da4dbfe12e666ac1566fb19821359		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE5E6 5296 bytes
font_01_sfnt_off0000f7e8.bin
7a54825106ce47fc0cb445913ff4a1fe6d4a0a810adbc819d5e81d7c40827540		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF7E8 10268 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.