Malicious PDF — malware analysis report

Static analysis result for SHA-256 9cb22d8a03c69ad1…

MALICIOUS

PDF

77.0 KB Created: 2021-03-23 00:00:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21
MD5: 6465377babaec482951d4de48758a439 SHA-1: 90b6cd785b254b6803e766a80074760fb7d5314c SHA-256: 9cb22d8a03c69ad11d3c4763e109e7506c0a919ffb80ff2cbedbd09ae02dd8c0
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'maypoin.ru', which is likely used to deliver a malicious payload or conduct phishing. The presence of PDF-specific heuristics and the overall detection score support the classification as a phishing or trojan delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/123?utm_term=jeans+size+guide+fashion+nova PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4486033/normal_5fe2c3fed061e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4393041/normal_5ff9cf0ea91f6.pdfIn PDF document text
    • http://gewarum.66ghz.com/87424108713.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408485/normal_60388d0ff3100.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4408599/normal_5ffc3abd47521.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4444885/normal_6007357dbac9e.pdfIn PDF document text
    • http://pakupuxojopef.getenjoyment.net/when_boy_meets_girl_joshua_harris.pdfIn PDF document text
    • http://xuxikurov.mygamesonline.org/mcdonalds_nutrition_calculator.pdfIn PDF document text
    • http://junumidutuzakox.getenjoyment.net/lamavakab.pdfIn PDF document text
    • http://verification-help.com/best_portable_jump_starter_and_air_compressor_ukyfm0s.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410443/normal_601fe0d64ba4f.pdfIn PDF document text
    • http://xelipev.22web.org/45569910740.pdfIn PDF document text
    • http://kyukty68.xyz/10406451570ggo5x.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383798/normal_603b106224b13.pdfIn PDF document text
    • http://kozidozilujivox.getenjoyment.net/zewuxon.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4501777/normal_5fd147ba4e3c2.pdfIn PDF document text
    • http://ver-alex.website/jutusezavonedutazonajiyd8my.pdfIn PDF document text
    • http://solusaxisabo.scienceontheweb.net/wobuwonujomifame.pdfIn PDF document text
    • http://digitalcalakk1.xyz/what_are_4_types_of_miningk4yn1.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://godutiliwaganos.rf.gd/33430537064.pdfIn PDF document text
    • https://s3.amazonaws.com/baposivarabuj/7437274892.pdfIn PDF document text
    • https://s3.amazonaws.com/kelukakeb/carry_on_luggage_size_jetblue_airlines.pdfIn PDF document text
    • http://poxemibusap.epizy.com/2019_acc_aha_hypertension_guidelines.pdfIn PDF document text
    • https://s3.amazonaws.com/geradi/zenith_transoceanic_royal-d7000y_11-band_radio.pdfIn PDF document text
    • https://s3.amazonaws.com/mulerux/gantt_chart_google_sheet.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000edf7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEDF7 5140 bytes
SHA-256: c50344e67f84e50e8197990c217ada54f2c643c42a2560877364284d9bb31767
font_01_sfnt_off0000ff8c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF8C 11536 bytes
SHA-256: 70bf3d42ba99a80a673604c57c81a2fa9c74070e155113a7ac69481a884eab84

Open this report in the interactive analyzer, or submit your own file for analysis.