Malicious PDF — malware analysis report

Static analysis result for SHA-256 990b4cf9e2bf90da…

MALICIOUS

PDF

91.8 KB Created: 2021-04-30 01:33:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 7682d3bd2fdce00c69b30f5f5602a121 SHA-1: 73279a2f105ef1fe410f334928504d71cac2845c SHA-256: 990b4cf9e2bf90da61de7614b569227af841b1b40295196ae5dbbb579a382e3f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that redirects to a suspicious domain, likely for phishing or malware distribution. ClamAV and ML classifiers flagged the file as malicious, indicating a high probability of malicious intent. The document body, though heavily obfuscated, suggests a lure related to 'phrasal verbs list'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=phrasal+verbs+list+get+through PDF link annotation
    • http://igcopyrightclient.com/why_does_my_cats_eye_bleed3n93m.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369173/normal_601485bb6ae2b.pdfIn PDF document text
    • https://cdn.sqhk.co/bubiwalifeda/icgoijd/webokuvafewuxomegi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454811/normal_6010b3a74e8f7.pdfIn PDF document text
    • https://cdn.sqhk.co/gufezitaxato/dZJshaK/dog_run_park_near_me.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372983/normal_60323b7695d47.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4470029/normal_5fe020b9debd3.pdfIn PDF document text
    • http://soldonlittleton.com/what_year_was_my_smith_and_wesson_38_special_madebjgei.pdfIn PDF document text
    • https://cdn.sqhk.co/tovisegag/b7gjmhd/uber_driver_app_issues.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/8fac0300-77b8-4c60-8ab4-5446ecdfa546/bowflex_xtl_recall_kit_instructions.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/53574131-ca35-426b-8c60-3cceb95ea498/what_to_eat_for_a_flat_belly.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/06d8e76b-0d23-4cea-a890-f1e5ec87e1de/43666553687.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/66f37108-66f9-41fe-81e2-56930bcdba63/rules_to_the_game_of_life_2016.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b6782f6e-b116-471f-8cf1-bc11f6bb2161/inorganic_chemistry_books_for_jee.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/10ffa211-4a54-4c54-b52f-b46a6a37dee1/which_describes_the_composition_of_the_ocean_floor_brainly.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/01259125-88d0-4916-b3d5-c54efab132c1/fasidibidudago.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ed8e03e0-8b7a-4ec0-9925-3a6ada9eea79/18041147588.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8b7ca721-08bd-4ae9-8ff4-7510528e3d9b/what_is_communication_and_its_importance.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/436af6b1-027b-4918-9d1a-0698e4fe827c/how_to_set_time_on_kenwood_kdc-138.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/691854e0-299a-427c-aeab-67ddcd8ddd9a/zuzovirivike.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012c1b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12C1B 5148 bytes
SHA-256: 43b714f1c3e0928a29fc4ef69a61b2c9b4e562a87460fc7396b73da7c5f9c243
font_01_sfnt_off00013d9d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13D9D 10704 bytes
SHA-256: d12f24d0713caecfe042d4e7fd332addb805a35cf1df4717f38c4085758d2550

Open this report in the interactive analyzer, or submit your own file for analysis.