Malicious PDF — malware analysis report

Static analysis result for SHA-256 97d64733ad97987b…

MALICIOUS

PDF

66.2 KB Created: 2021-06-13 18:05:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b0bf95edb304f8d950dcaf3fb316fe21 SHA-1: 723bf71f2244e65722daf0f38c4574bf10653e1d SHA-256: 97d64733ad97987bafff19ad8bad8c162f1e62bf8736cc5579fa226228aaad90
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to 'catamma.ru', which is likely a phishing or malware distribution site. The presence of this URL suggests the document's primary purpose is to redirect users to a potentially harmful external resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://catamma.ru/pbw?utm_term=shirdi+sai+baba+patalu+telugu
    • https://cdn-cms.f-static.net/uploads/4367645/normal_606ccfd78e6b7.pdf
    • https://cdn-cms.f-static.net/uploads/4474456/normal_6023e50952ae3.pdf
    • https://cdn-cms.f-static.net/uploads/4405185/normal_601831b8c418c.pdf
    • https://cdn-cms.f-static.net/uploads/4408479/normal_604f6ea4a109a.pdf
    • https://static.s123-cdn-static.com/uploads/4482191/normal_5fdd414315ea7.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/3b5f5024-cf44-4992-aa81-0d6749614432/ice_age_3_full_movie_in_hindi_dubbed_online.pdf
    • https://uploads.strikinglycdn.com/files/82d1f467-6fbc-4a6b-8240-58ef207aba52/12889051938.pdf
    • https://uploads.strikinglycdn.com/files/37750b75-248b-4d0c-9bd9-5e2ebba0411a/canon_pixma_mx922_printer_for_sale.pdf
    • https://uploads.strikinglycdn.com/files/7e750dea-11f2-4dc3-a400-941bf6224d56/the_go-giver_summary.pdf
    • https://uploads.strikinglycdn.com/files/f9d62a52-26fe-4d0f-a6dc-6dd8072d8098/lezuzef.pdf
    • http://faxamom.pbworks.com/w/file/fetch/145024791/gospel_music_praise_and_worship_songs.pdf
    • https://uploads.strikinglycdn.com/files/63dfe990-b97a-4568-b6cb-e7c15a32b4f7/debewakusiroliguvujedidob.pdf
    • https://uploads.strikinglycdn.com/files/c32c6ca7-346f-4251-b18c-7e318d0c2581/feserazazupuxikuduvazab.pdf
    • https://uploads.strikinglycdn.com/files/58007801-a4fa-4288-abc3-0cd69e0c063e/singer_futura_ce-150_manual.pdf
    • http://jiboduxoguv.pbworks.com/w/file/fetch/144556932/85824901773.pdf
    • http://padimagofo.pbworks.com/w/file/fetch/145076817/19729921280.pdf
    • https://uploads.strikinglycdn.com/files/7ce5bd6b-e981-4ded-9bc2-4e37d3e26322/how_to_play_a_penny_whistle.pdf
    • http://sufasujozu.pbworks.com/f/how_to_get_sentry_safe_open_without_key.pdf
    • http://lonazak.pbworks.com/f/76577981808.pdf
    • http://medodadepud.pbworks.com/w/file/fetch/144646782/97969160774.pdf
    • https://uploads.strikinglycdn.com/files/1be2472c-5ec0-414a-b835-e20d30b17f9c/literature_a_portable_anthology_free.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c74b.bin
03aeafb0f923861b203e110083c47d4cf41b85413e3fe1cd2e86c25c25dcc913		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC74B 5464 bytes
font_01_sfnt_off0000d9ca.bin
6656c2287a92b931f9d1f036eed360da383dcd950cee3944bc2729f43e6fa63e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD9CA 10192 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.