Malicious PDF — malware analysis report

Static analysis result for SHA-256 9feaedf722d4391d…

MALICIOUS

PDF

77.6 KB Created: 2021-05-07 23:42:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ef46d35f4223adb7bad63dbefa3b4742 SHA-1: 82e7bce098a8a6c78832517ea1552b28d3f421bc SHA-256: 9feaedf722d4391d4115761b7615a7212dfccbfc11cd8003167c02c39bdb634b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that, when accessed, likely leads to a phishing or malware download site. The document body, though heavily obfuscated, contains keywords related to search terms, suggesting a lure. ClamAV and ML classifiers strongly indicate malicious content, specifically a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=peterbilt+service+truck+toy
    • https://cdn-cms.f-static.net/uploads/4387244/normal_605bfdb16022c.pdf
    • http://copyrightnotices-form.com/765158153289p9hl.pdf
    • https://cdn-cms.f-static.net/uploads/4377414/normal_6068ad165787b.pdf
    • https://static.s123-cdn-static.com/uploads/4426960/normal_5fddb5da5edbd.pdf
    • http://wiinorama.space/kijudujugovun0hjhh.pdf
    • https://static.s123-cdn-static.com/uploads/4383687/normal_5fcab528d2861.pdf
    • https://cdn-cms.f-static.net/uploads/4450504/normal_6039b16f4920a.pdf
    • http://mkr-olimp.info/63308619983hyull.pdf
    • https://cdn-cms.f-static.net/uploads/4447915/normal_603eead7a18f5.pdf
    • http://zvezdasevera.online/phd_thesis_powerpoint_templatezvnr5.pdf
    • http://dwatches.site/916951685510l1re.pdf
    • https://cdn-cms.f-static.net/uploads/4369322/normal_601c949c14954.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://ed36ca5d-e6e9-4caf-8bbb-3a8af5cfee16.filesusr.com/ugd/971556_cd2c155e822846c299430822bf68967e.pdf?index=true
    • https://s3.amazonaws.com/wexukufedepim/how_to_set_up_a_sundance_hot_tub.pdf
    • https://f33d1b56-f518-462b-b61f-c1b5c1ba661c.filesusr.com/ugd/1c44ce_4c31b2077c10448b90b7bb385234b234.pdf?index=true
    • https://3c59ccad-08dd-474b-8af0-a42d91f20399.filesusr.com/ugd/489ff0_5a7460387c1c4d2b8ce4919ec7f01dba.pdf?index=true
    • https://s3.amazonaws.com/mipizaju/apec_concept_note_template.pdf
    • https://s3.amazonaws.com/petikamov/85877746926.pdf
    • https://uploads.strikinglycdn.com/files/9f7a7781-0b72-4849-b8a5-abcd824f8da7/forgot_dsc_user_pin.pdf
    • https://uploads.strikinglycdn.com/files/d161a255-edd2-44f6-8803-342a6e83e59e/how_to_start_troy_bilt_2410.pdf
    • https://s3.amazonaws.com/lovetijif/afda_mean_median_mode_range_worksheet_answers.pdf
    • https://8b83d164-5e56-46cc-b941-48f48810ddf3.filesusr.com/ugd/76ce43_adfd0b2e94844183b3cf48e4d00ca0d8.pdf?index=true
    • https://592908bf-dd96-48cc-88d9-ffebbdd10d84.filesusr.com/ugd/f34823_678e994f8fb540cda36acd50ca4081b7.pdf?index=true
    • https://s3.amazonaws.com/zopenave/geduwoxe.pdf
    • https://uploads.strikinglycdn.com/files/df58e3af-934b-4473-bf76-3411b34416af/fitness_blender_workout_routine.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f2be.bin
d9be64f646ce49354b5fc1bfa29c1750ee2b5542191c618e22913c2b6d1a8bdd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF2BE 4952 bytes
font_01_sfnt_off000103bb.bin
3381e6063676706d39fe8f165f8bf74c4264882007feff927cf03c8fbacccded		 pdf-font-stream PDF embedded font (sfnt) at offset 0x103BB 10784 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.