Malicious PDF — malware analysis report

Static analysis result for SHA-256 9be89fcc4910bf16…

MALICIOUS

PDF

77.3 KB Created: 2021-06-05 03:34:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: edeada0d89482ee37eadeabcd76dbc9e SHA-1: 674efce5d3e70a49939c530c041bed1bd69a3815 SHA-256: 9be89fcc4910bf16915f8bcd99fced5755b12f8be99141e488eb811e7bd0bf29
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious URL, which is likely part of a phishing or malware distribution scheme. Although no scripts were explicitly extracted, the PDF structure and the presence of an external URI suggest it's designed to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9956

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://krisoc.ru/pbw?utm_term=how+to+hide+apps+in+the+app+library
    • https://cdn-cms.f-static.net/uploads/4414352/normal_60565ece9c571.pdf
    • https://static.s123-cdn-static.com/uploads/4384472/normal_6002fb3584587.pdf
    • https://cdn-cms.f-static.net/uploads/4481406/normal_5fdac6091ad28.pdf
    • https://cdn-cms.f-static.net/uploads/4491669/normal_603a8e54cdd05.pdf
    • https://cdn-cms.f-static.net/uploads/4490376/normal_603a6b22f2821.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://puzavofan.pbworks.com/w/file/fetch/144579843/bipegelotulutanezanonapod.pdf
    • https://uploads.strikinglycdn.com/files/c94cab3b-356f-42c6-abaa-f5bb13887dda/chuunibyou_demo_koi_ga_shitai_2.vad_12.rsz.pdf
    • https://uploads.strikinglycdn.com/files/3f5971e3-d354-4b04-bfcf-e8d5a6687301/wudumomirazinijudeza.pdf
    • https://uploads.strikinglycdn.com/files/f6960f1f-25ea-4923-83d1-f75a51a23191/77834898716.pdf
    • http://wufamazajo.pbworks.com/f/how_to_retrieve_deleted_photos_from_memory_card_free_software.pdf
    • http://liwuvedesisu.pbworks.com/f/what_are_four_types_of_ecosystem_services.pdf
    • https://uploads.strikinglycdn.com/files/d50c4b84-c508-41b6-b256-119c3d3df411/10773291172.pdf
    • https://uploads.strikinglycdn.com/files/a36b66c0-5b1c-4303-bb3a-476753883c68/samsung_hw-e450_check_subwoofer.pdf
    • https://uploads.strikinglycdn.com/files/a7be2b9f-cb49-4a63-814d-acf6c25fe6c6/15285893859.pdf
    • https://uploads.strikinglycdn.com/files/20634580-fdb3-4180-b80b-d4b132b2b72b/how_to_make_womens_toga_costumes.pdf
    • https://uploads.strikinglycdn.com/files/bbadc2df-9233-494d-869d-5233523cfd1d/do_shoe_stretchers_really_work.pdf
    • https://uploads.strikinglycdn.com/files/18168996-2d94-4f2e-a785-8c3e61136663/nlt_study_bible_free_download.pdf
    • https://uploads.strikinglycdn.com/files/eab35fe5-4f21-4084-8ea8-8a19bc2485bd/has_empire_ended.pdf
    • http://kekirow.pbworks.com/w/file/fetch/144636870/lememamefatoki.pdf
    • https://uploads.strikinglycdn.com/files/ca840972-984c-44ac-8199-e254938d7131/modesusonirezavobos.pdf
    • http://doxawadar.pbworks.com/f/grulla_japonesa_origami_significado.pdf
    • https://uploads.strikinglycdn.com/files/3d96b7c8-1c6a-4e3c-b928-d40099b8c229/vunofimogexosigunat.pdf
    • https://uploads.strikinglycdn.com/files/ddfe6f39-5041-4d39-b2e5-12925c2d0b36/how_to_download_pokemon_sword_and_shield_on_pc_2020.pdf
    • https://uploads.strikinglycdn.com/files/f853e608-0ac6-4387-9082-9488d7feffd2/lazule.pdf
    • https://uploads.strikinglycdn.com/files/dd62ab92-2f1b-452e-b75c-88a7c0d15778/53252521528.pdf
    • https://uploads.strikinglycdn.com/files/4c270358-c27c-4971-b247-7dae44f98aff/bitosikirur.pdf
    • https://uploads.strikinglycdn.com/files/a1c732d4-82b3-443e-b7e3-3ce047599e12/dekabereti.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f18c.bin
24faea2df7d546900d96b5dd72c51c823e9a6bc22ee128a3478586e63025da7c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF18C 5344 bytes
font_01_sfnt_off000103b9.bin
bc4d51294a6bacd656493ba095fb0ae9f9a2a1e9a0a9d4ba7ad04b11a21d3c46		 pdf-font-stream PDF embedded font (sfnt) at offset 0x103B9 10436 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.