Malicious PDF — malware analysis report

Static analysis result for SHA-256 9e01dab46a373650…

MALICIOUS

PDF

74.5 KB Created: 2021-03-24 12:01:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a148263091fd8e3ce48a87cda6255766 SHA-1: 61d14c24fea49632dc1124ab18609d55e42ed966 SHA-256: 9e01dab46a373650eedcdd7cf77956867da3980b6d4323ff0e62ffb96cc06f36
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains an embedded URI pointing to a URL that appears to be a search result for a book. This is a common lure for phishing or malware distribution. ClamAV detection and ML classification strongly indicate maliciousness, specifically as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/wix?keyword=american+gods+neil+gaiman+free+pdf
    • https://static.s123-cdn-static.com/uploads/4502698/normal_5fcb57700fe77.pdf
    • http://wellwork.site/31636546079dd3me.pdf
    • http://roboludawu.mywebcommunity.org/bedelli_askerlik_kanunu_2020.pdf
    • https://cdn-cms.f-static.net/uploads/4489609/normal_5fda9043184c8.pdf
    • http://mekujoviwe.mypressonline.com/author_robert_t._kiyosaki.pdf
    • http://selectgetc.top/823203165173l8ra.pdf
    • http://vavazexowupex.medianewsonline.com/saxetedomewit.pdf
    • http://vizexibidoxi.getenjoyment.net/blood_bowl_2_guide_chaos.pdf
    • http://soferijivav.getenjoyment.net/50575424988.pdf
    • http://xosubowavenu.mypressonline.com/zemefinivitik.pdf
    • http://jaraxusej.iblogger.org/fluke_microscanner2_professional_kit.pdf
    • http://kirakexig.mypressonline.com/27749838319.pdf
    • http://lojuxaga.mywebcommunity.org/anemia_falciforme_sintomas.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/5f80b5a1-5320-42c6-9c0f-8fe62e8d560f/gta_san_andreas_superman_mod_cheats_codes_download.pdf
    • https://uploads.strikinglycdn.com/files/aa06905b-c360-405b-81c1-d57b9ac71d1b/55160327064.pdf
    • http://genenapukiral.epizy.com/38337595613.pdf
    • https://uploads.strikinglycdn.com/files/aadfab2d-72a7-4b86-b79c-07c54f109a24/husqvarna_hu700h_mower_blade.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e602.bin
796c4a9ad9b05bc47856e65f0349b237416e93d867c3450188d4742b0281707a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE602 5464 bytes
font_01_sfnt_off0000f882.bin
3cddbcc12e812df714d01c51158e3fdddf6ec6de94fd240899ba1fa1f9bfaadd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF882 10816 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.