Malicious PDF — malware analysis report

Static analysis result for SHA-256 95de438dfbd2b0b1…

MALICIOUS

PDF

69.0 KB Created: 2021-04-17 21:52:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 90f7cb6343d921c961b42feb01f66690 SHA-1: 7362c4e07bcf6e805ab67929538d06592214223f SHA-256: 95de438dfbd2b0b1f7226dbc51d3012ec1eb53cd51bccbdb19aefd29a0f9b779
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. The document body, though heavily obfuscated, appears to contain keywords related to product listings, suggesting a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=traktor+s4+used
    • https://cdn-cms.f-static.net/uploads/4470841/normal_5fe84a3e80b80.pdf
    • https://static.s123-cdn-static.com/uploads/4425501/normal_5ffd74f0df3e6.pdf
    • https://static.s123-cdn-static.com/uploads/4379719/normal_5fe34f70c405f.pdf
    • https://cdn-cms.f-static.net/uploads/4475565/normal_600d690521d0e.pdf
    • http://maritimog.medianewsonline.com/sql_server_database_interview_questions_and_answers.pdf
    • https://cdn-cms.f-static.net/uploads/4383334/normal_6019a8026747a.pdf
    • http://dujifasuda.iblogger.org/tasusodazema.pdf
    • http://rajukilodagoje.mygamesonline.org/zuguleruvebiguzutakufegar.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://pitetuli.epizy.com/fakolufebokiwori.pdf
    • https://uploads.strikinglycdn.com/files/9582dab2-f75d-46fb-a21e-76273a19a794/359225691.pdf
    • https://uploads.strikinglycdn.com/files/86dd8691-2729-446a-9634-9ae7b1195ebf/jadozusu.pdf
    • https://uploads.strikinglycdn.com/files/ae878597-d236-472c-9565-59ff2c019788/ms_7641_ver_4.0_motherboard_manual.pdf
    • https://uploads.strikinglycdn.com/files/cdfa2d15-6444-4079-ae13-b16f40c7137c/wemewopumajomokosigugowu.pdf
    • https://uploads.strikinglycdn.com/files/151e8396-05e1-4482-b5fe-14055bff7490/4344087937.pdf
    • http://tevaluzax.atwebpages.com/37377264178.pdf
    • https://uploads.strikinglycdn.com/files/ca1dce40-fd7f-410a-aecd-ce138688101d/interior_design_degree_in_usa.pdf
    • https://uploads.strikinglycdn.com/files/5635627c-a070-429b-83c4-aa2b63e78883/what_is_deterrence_theory_of_punishment.pdf
    • https://uploads.strikinglycdn.com/files/4c7630e6-8425-443d-b574-3263a456695c/90762058168.pdf
    • https://uploads.strikinglycdn.com/files/f87b5ea0-2e90-4bad-bf3a-fd5cbf29f025/sepuzijikipu.pdf
    • https://uploads.strikinglycdn.com/files/b6152fe3-8d07-42e1-8989-b9a9097d2028/how_to_get_rid_of_military_time_on_armitron_watch.pdf
    • https://uploads.strikinglycdn.com/files/623ffad7-985e-40b5-b1b4-487ac3fc4c4b/historia_universal_de_la_infamia_epub.pdf
    • http://bajawawuriz.epizy.com/14915226421.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d0b7.bin
3093b4d5df428746f6737b289032bfdfe75fddf944472a19b2f423408f08d27c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD0B7 4888 bytes
font_01_sfnt_off0000e168.bin
92d5e281035c97e63ae91f1ab74d999081e66ea9bdf4dbf78a574eab1a640b52		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE168 10552 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.