Malicious PDF — malware analysis report

Static analysis result for SHA-256 992b012120b262a3…

MALICIOUS

PDF

78.1 KB Created: 2021-03-09 13:30:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0c33255df836d05040ad73420bd0327d SHA-1: cf06d983e250654c195d4f02b826e4f51a7cdedd SHA-256: 992b012120b262a3ca596a930de2dde74c7caed7a48c3f69ba3efe4fe84284db
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The ML classifier and ClamAV detection strongly indicate maliciousness. The PDF contains numerous embedded URLs, with at least one, https://dafemum.ru/award?keyword=beautiful+creatures+book+series+pdf, being flagged as an external URI. While the document body is heavily obfuscated, the presence of these URLs suggests a phishing or malware distribution attempt, likely leveraging a social engineering pretext. No scripts were extracted, but the PDF structure and embedded URIs are sufficient indicators.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=beautiful+creatures+book+series+pdf
    • http://dixojele.22web.org/bluecross_blueshield_of_illinois_claim_review_form.pdf
    • https://cdn.sqhk.co/sevafeluba/ieRugga/8208638221.pdf
    • http://meetchambre.xyz/craftsman_leaf_vacuum_shredder_bagger_bloweragq4l.pdf
    • https://cdn.sqhk.co/somepizeko/fificOz/21887753586.pdf
    • http://reabook.online/what_does_restrictions_a_mean_on_a_georgia_driver_licenseqwfms.pdf
    • https://cdn.sqhk.co/pimidima/aprihjc/wejegabovedevulu.pdf
    • http://vupirure.22web.org/java_swing_gui_programming.pdf
    • https://cdn.sqhk.co/rojarasam/hdcojjh/nuwufonufiwuvafefatagafef.pdf
    • https://cdn.sqhk.co/worenora/fibMwgg/xurum.pdf
    • https://cdn.sqhk.co/numovasovev/XaCpjKi/idle_builders_bradford.pdf
    • https://cdn.sqhk.co/xiladuxe/jcqvIec/bts_korean_song_lyrics.pdf
    • https://cdn.sqhk.co/labifikup/hc5Ejcr/64511721886.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/c59f9178-8ffa-4317-b825-a6b6469ec3b9/genivexaxem.pdf
    • http://gufolisalowu.rf.gd/how_often_do_you_need_to_change_transmission_fluid_honda_civic.pdf
    • https://uploads.strikinglycdn.com/files/a964d131-4773-4b08-b225-80de557e544f/1412020697.pdf
    • https://uploads.strikinglycdn.com/files/b2f0926b-9322-4d29-9b42-f1324eab2573/iso_9001_download.pdf
    • http://tizajizori.epizy.com/the_culture_of_the_characters_in_the_time_of_butterflies_includes.pdf
    • https://uploads.strikinglycdn.com/files/33081803-c91c-4fb5-a09c-62cd21c7fe57/android_app_development_free_online.pdf
    • https://uploads.strikinglycdn.com/files/5c926cfc-25c8-4f65-91ce-0066167d38cf/new_criticism_literary_lens.pdf
    • https://uploads.strikinglycdn.com/files/34304cb0-6393-4f95-a7cd-dd294ce966aa/what_is_share_to_news_feed_on_facebook.pdf
    • http://denotepisijolib.rf.gd/is_there_any_nutritional_value_in_romaine_lettuce.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e88e.bin
c714901f74b08df7341d670e0eefe0fb0f9793aebb6de36a9a2a21e97b0301bd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE88E 5180 bytes
font_01_sfnt_off0000fa36.bin
371adfa5e192ef194324d62332f5fd31e35a37b143812ef112d58212361c7d64		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA36 10000 bytes
font_02_sfnt_off00011c7e.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11C7E 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.