Malicious PDF — malware analysis report

Static analysis result for SHA-256 9df3714f9b829904…

MALICIOUS

PDF

81.1 KB Created: 2021-04-23 22:07:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dc1bfab60207cc9c4f0ab9afb43ce8f6 SHA-1: 44f71c2a636be73869f642454989e608d72c128d SHA-256: 9df3714f9b82990434c5ecfb70f7d373c31854d8f01a5ddd1405e144cec4360b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, and it contains an embedded URL pointing to a suspicious domain. The document body, though heavily obfuscated, suggests a lure related to 'office us scripts pdf', indicating a phishing or social engineering attempt. The presence of an external URI heuristic further supports the malicious intent of directing users to a potentially harmful website.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=the+office+us+scripts+pdf
    • https://cdn-cms.f-static.net/uploads/4376096/normal_606e1a040ee57.pdf
    • https://cdn-cms.f-static.net/uploads/4410207/normal_60648c26a1e19.pdf
    • https://cdn-cms.f-static.net/uploads/4472776/normal_5fe9021e275a1.pdf
    • http://detonic-official.website/how_to_see_my_blocked_phone_numbersdwu28.pdf
    • http://hrushch.space/sierra_load_data_308_155_tmkyerv2.pdf
    • http://manthoughtswebsite.website/what_medicine_is_given_during_cardiac_arrestx50s4.pdf
    • http://world-wild-shop.com/497741292454fp5x.pdf
    • http://remontnatali.ru/426293723320nzh0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/e58c1de7-b6e6-4873-9096-effc2ed980dd/ps3_controller_rechargeable_battery_pack.pdf
    • https://ac65beef-1c88-4b01-a948-251493ed82f2.filesusr.com/ugd/09857b_0613499772ca439c9c30ccb3a46a8363.pdf?index=true
    • https://uploads.strikinglycdn.com/files/831559d9-0c14-47e1-b6d7-b5965476294d/whirlpool_refrigerator_ice_maker_not_making_enough_ice.pdf
    • https://uploads.strikinglycdn.com/files/373c7cb6-0a94-40f5-a6fc-743eb1700127/is_outlander_on_netflix_uk.pdf
    • https://94ac7338-8c66-48ed-b7e4-01cccba3eff0.filesusr.com/ugd/9b8421_6e738ee9254c449297198eb67953cae5.pdf?index=true
    • https://uploads.strikinglycdn.com/files/b5f53028-81da-44c6-ab59-2abf6e3115ba/how_to_reset_kidde_carbon_monoxide_alarm_after_power_outage.pdf
    • https://uploads.strikinglycdn.com/files/46e8fb29-bc54-4e32-acfd-bff23476daf9/midsummer_nights_dream_script_act_1_scene_1.pdf
    • https://uploads.strikinglycdn.com/files/2593a5a6-f261-464f-9f3a-e51a5559d5a5/31530356397.pdf
    • https://uploads.strikinglycdn.com/files/b35481dd-cfdf-4a4e-9aeb-e35522179db7/19480190113.pdf
    • https://80f75f89-a1e3-4611-a0ef-7a704eb82da9.filesusr.com/ugd/0286dd_759b6beb0c9f46ce8c817910a688d684.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f19f.bin
97c6d557e4eeeb7f20231eb52adbb833e2309c2ee0c89f627932f7d8564aabcb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF19F 4724 bytes
font_01_sfnt_off000101c7.bin
4792b890b6b4988e19276d944377916e208404913ac1fa224798b50f8ba69cff		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101C7 11576 bytes
font_02_sfnt_off0001294c.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1294C 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.