Malicious PDF — malware analysis report

Static analysis result for SHA-256 97613d44ac717692…

MALICIOUS

PDF

76.0 KB Created: 2021-03-19 13:12:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 27b908efae44375391c7942c6b7c2ca1 SHA-1: 2d80368f5a0bfdc72e959ef2a268558fc54646ef SHA-256: 97613d44ac717692f57a822fc3cec484fc43cdd251ffbad25b082376fa229b85
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains an embedded URL disguised as a search result for a technical manual. The ML classifier and ClamAV detection strongly indicate malicious intent, likely to deliver a phishing payload or malware. The presence of multiple suspicious URLs further supports this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=molecular+cloning+a+laboratory+manual+pdf+download
    • http://pycnidwzxc.info/lutesapagijujupokos0n9hh.pdf
    • https://cdn.sqhk.co/susorajin/hpmGOrU/wallpaper_lock_screen_iphone_x.pdf
    • https://cdn.sqhk.co/xizowabik/WY8jdKy/fusionner_2_pages_en_ligne.pdf
    • https://cdn.sqhk.co/lobinazema/0hjpzjb/islam_ka_hero_number_van.pdf
    • http://future-techno.ru/muburegegimibodonorunkh.pdf
    • https://cdn.sqhk.co/ginudaket/jjhIyii/2020_farm_aid.pdf
    • https://cdn.sqhk.co/tefebenum/hghlxjb/zufuzubalijonon.pdf
    • http://apkweb.net/free_dj_song_mixer_software_downloade1zl9.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/a7a5f6e5-18b0-41a8-9225-5f6a6655d602/citizen_jy8020-52e_eco-drive_promaster_sky_skyhawk_titanium.pdf
    • https://uploads.strikinglycdn.com/files/9f2bc6fa-7e50-480e-9d33-34ac96b0a394/human_resource_management_project.pdf
    • https://uploads.strikinglycdn.com/files/741f185a-935d-48ba-9ac0-6a2e8dc44f0a/35331076269.pdf
    • https://uploads.strikinglycdn.com/files/c97c4a2e-8bf8-44b9-bbfd-8079b79e187c/10126609423.pdf
    • https://uploads.strikinglycdn.com/files/1c9aab78-0577-4c5b-bf23-e3faeada365f/wonuboxejatatifabipi.pdf
    • https://uploads.strikinglycdn.com/files/cecfb94b-ccfb-4b62-914a-f90e5c4c99a7/fasososewiva.pdf
    • https://s3.amazonaws.com/rijaliwiguvex/los_angeles_times_homicide_report_2018.pdf
    • https://uploads.strikinglycdn.com/files/dd2073dd-4132-4ba5-988d-76378a3dffe3/how_efficient_are_mitsubishi_mini_splits.pdf
    • https://uploads.strikinglycdn.com/files/acc4c9fc-3541-4611-8f69-0eacffbe8653/is_southwest_premier_card_worth_it.pdf
    • https://uploads.strikinglycdn.com/files/73926f85-f682-46dc-be9f-ebcb7ad11bfc/what_batteries_does_an_olympus_om10_take.pdf
    • https://s3.amazonaws.com/fuzafuzeruwit/clone_hero_songs_spreadsheet.pdf
    • https://uploads.strikinglycdn.com/files/01b6f84c-160a-4f8e-a194-5f01bde2b22c/vopebixor.pdf
    • https://s3.amazonaws.com/wivunonovef/hp_envy_4500_owners_manual.pdf
    • https://uploads.strikinglycdn.com/files/8cf35bf3-ba18-440d-92f6-08feaae49cc7/gubuvodujigafawomiwuwesaw.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e711.bin
fd036372f51fde6617c2d5356aa11d9ae4f18dc3d13ecb5cc2a00c0e3a380c4e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE711 5636 bytes
font_01_sfnt_off0000fa49.bin
fdc048afdf898e476badbdc8baecb0d77a44dec15d4b308c040a82c757821a82		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA49 11192 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.