Malicious PDF — malware analysis report

Static analysis result for SHA-256 9fd9daa28f6ca4c5…

MALICIOUS

PDF

82.6 KB Created: 2021-03-22 04:35:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1a7720c859c338fc0955e46f02404fae SHA-1: 20fb1f7ba6fed82d26f9db723c58a673bfa1df83 SHA-256: 9fd9daa28f6ca4c5255e8053f69502e29a2b4541dd812c70a71f9222e6f4f5f5
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, with ClamAV identifying it as 'Pdf.Phishing.Trojan'. The document contains an embedded URL pointing to 'dafemum.ru', which is likely part of a phishing or malware distribution scheme. The presence of multiple unknown URLs further supports the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=how+to+use+suddenlink+remote+for+tv
    • https://cdn.sqhk.co/debefuki/g8jfGjg/wwe_shop_gift_card_walmart.pdf
    • https://cdn.sqhk.co/bitaxukezor/dhgQhdk/puzzle_piece_emoji_green.pdf
    • http://bred-enligne.com/80129228914gf91w.pdf
    • http://gakawisogafuga.mygamesonline.org/41254286959.pdf
    • http://freud.icu/fezosisupufuwoq9czq.pdf
    • https://cdn.sqhk.co/lasanamemego/cihgfZ7/d_d_5e_paladin_oath_of_heroism.pdf
    • http://natnat.fun/how_to_clean_my_rowenta_iron_plateojlj1.pdf
    • http://mekomob.getenjoyment.net/sixozaged.pdf
    • http://dalnoboyi.xyz/pazepoxumebozebe5vxwx.pdf
    • http://desokore.medianewsonline.com/major_issues_facing_higher_education_today.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/452c73fe-bed6-4e6e-943e-273b742a10f5/45372996771.pdf
    • https://144c9d4d-401b-437b-b89f-6a5816d7da47.filesusr.com/ugd/cd33f5_dc19c9be755c43b49ec202f3b4a34a12.pdf?index=true
    • https://e79dab91-b8ca-4f03-a7cf-74564eaa1d8a.filesusr.com/ugd/009cd4_0ee680e150e1446fb14e2d9a00305c3c.pdf?index=true
    • https://s3.amazonaws.com/vetamedisoz/80391496245.pdf
    • https://uploads.strikinglycdn.com/files/51420b17-6a19-40ec-809d-8cfc7855fcca/44372472651.pdf
    • https://s3.amazonaws.com/piwupevivotixi/mobebejutexerolewi.pdf
    • https://s3.amazonaws.com/dozore/61805034015.pdf
    • https://357b8bef-7330-4cfe-b31d-389db25c4d5a.filesusr.com/ugd/4c76bf_61a68572a49c4e15ad34720a9bf8d804.pdf?index=true
    • https://s3.amazonaws.com/vovabagubajegeb/masters_program_resume_template.pdf
    • https://a5a8f6e1-24ae-425c-880d-6f4079e3c376.filesusr.com/ugd/035627_cf0a0693bfe14b0098b0f9e711526c31.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f978.bin
521d292f02066c86c1ae9174641881349729d95d045186aa7ace274485d34578		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF978 4904 bytes
font_01_sfnt_off00010a1c.bin
e69d58c9348d1b40fd1ce788a5b0c341a623714a42bca0913fb93c5b5dda2ed8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A1C 10628 bytes
font_02_sfnt_off00012ea0.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12EA0 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.