Malicious PDF — malware analysis report

Static analysis result for SHA-256 96883e759d399388…

MALICIOUS

PDF

205.5 KB Created: 2021-03-17 11:32:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10
MD5: fbb463c9399b714b28d8b63cd8089ad6 SHA-1: 65ecb219f292e20169208c3823dd5d77e346161d SHA-256: 96883e759d3993888569c9fc07e21882e66e0185155b4641c3e2516e05c65d49
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, which is indicative of a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. Although no scripts were extracted, the presence of an external URI in the document body, combined with heuristic firings, points towards a phishing lure designed to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9895

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/award?keyword=m.+a+political+science+notes+in+marathi+pdf PDF link annotation
    • https://cdn.sqhk.co/baxikomo/jghcr4L/besame_mucho_sheet_piano.pdfIn PDF document text
    • http://hocostyle.ru/far_cry_blood_dragon_achievement_guide9k0wq.pdfIn PDF document text
    • https://cdn.sqhk.co/vafodagusun/j7jd1lI/wafipujoxidemadilidi.pdfIn PDF document text
    • http://nageramuvepom.mywebcommunity.org/newum.pdfIn PDF document text
    • https://cdn.sqhk.co/vaxarogajib/iaxhhhb/fitadodunebopijoxufa.pdfIn PDF document text
    • https://cdn.sqhk.co/remowiwa/89qmxje/door_kickers_mod_apk_1._0._99.pdfIn PDF document text
    • http://vilopeg.xyz/philips_avent_baby_bottle_electric_steam_steriliser_3_in_1dcudq.pdfIn PDF document text
    • https://cdn.sqhk.co/ranetixeba/ejjNjbA/define_nostalgic_antonym.pdfIn PDF document text
    • http://tagoturuluro.medianewsonline.com/mesezajidavis.pdfIn PDF document text
    • http://ridovise.sportsontheweb.net/8-4_skills_practice_trigonometry_with_work.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://3745348a-78a0-42d7-8ff4-af2b45bf5faf.filesusr.com/ugd/02631b_d591a4db2faf4e8f878b4730f708fa3c.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/c5ea2b72-2763-4f8e-aa13-662e73762f1e/jibesulegorid.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/78352af8-6f2a-4f5d-94eb-a1fd28a47e18/99446906453.pdfIn PDF document text
    • https://160e4e15-e27a-4ef2-9b26-f67fc0969a86.filesusr.com/ugd/cbdbb6_097adab31e454cbe896b40782201a393.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/dbba1de8-081e-485b-913a-53296c483e56/dokuxat.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/02d1bf25-ca60-4c0d-bdde-4c139bfc2063/lizuf.pdfIn PDF document text
    • http://zisukuvi.atwebpages.com/30361011717.pdfIn PDF document text
    • https://be8414c4-f2d5-40c6-b8a8-1a5561a1dac7.filesusr.com/ugd/a452ea_85252f13d95b4db9aa25d19919d38d7d.pdf?index=trueIn PDF document text
    • http://zaxuzut.atwebpages.com/rimatogefafalokiwesoxo.pdfIn PDF document text
    • https://30621b86-6952-4b41-80af-4d24d830bc7c.filesusr.com/ugd/122077_7b7804905bb14e62ad3240a19cf70cd2.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002c4c3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2C4C3 5432 bytes
SHA-256: 4f0eb6ee40c6a2077b9113c66d2cc1e51cae4385aecab2b022972aea1c9a27dd
font_01_sfnt_off0002d71b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2D71B 3740 bytes
SHA-256: eb903a4bcabb0673128613fc2c6a3b3be6b6be0204d11159aa2f590e1d82ee93
font_02_sfnt_off0002e294.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2E294 15852 bytes
SHA-256: e13331af10e9cb8291097f12bfaa4bd8a160831aad1fb3e9b6327856471ad9de
font_03_sfnt_off00031112.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x31112 6672 bytes
SHA-256: 600a9df945b375c69d0fc40edd794eb86ad4ff8d68d3292abadd4199861cd84d

Open this report in the interactive analyzer, or submit your own file for analysis.