Malicious PDF — malware analysis report

Static analysis result for SHA-256 a09c03175440222b…

MALICIOUS

PDF

411.6 KB Created: 2021-03-18 22:22:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a760c8c38e94f5e66e725d6977642079 SHA-1: 8d1681b16335f0b335c665cd418eba5fb3818302 SHA-256: a09c03175440222baf7d31907a1e1dd72644c9e42c0c3d8cb223d3bb428c3978
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic firing for an external URI pointing to a suspicious domain, which is also listed as an IOC. The ML classifier and ClamAV detection strongly indicate maliciousness. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest a phishing or malware distribution attempt, likely using a social engineering lure to trick users into visiting the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9936

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=angels+in+america+full+text+pdf
    • https://cdn.sqhk.co/tozimozeka/hjeic75/utorrent_classic_mac.pdf
    • https://pigamudabuv.weebly.com/uploads/1/3/4/2/134235231/werumo_desapegifoma_wanezojabu.pdf
    • https://cdn-cms.f-static.net/uploads/4459621/normal_603deee82a735.pdf
    • https://cdn.sqhk.co/nizekidido/idhgqgj/19771303923.pdf
    • http://sokfresh.fun/sentry_fire_safe_1170_lost_key4ntcd.pdf
    • http://lessonsonline.site/butujajuwetapixalupbe8mv.pdf
    • https://cdn.sqhk.co/kesavaki/aiehbjc/61449586170.pdf
    • https://kubamugikogili.weebly.com/uploads/1/3/4/5/134508843/71298.pdf
    • https://cdn-cms.f-static.net/uploads/4372719/normal_6011b64c79910.pdf
    • https://vawilateg.weebly.com/uploads/1/3/4/6/134697686/bupufonerobewad.pdf
    • http://stakingyfi.com/60011173996fx5dm.pdf
    • https://cdn.sqhk.co/xufojidaju/WLlijgd/hydroelectric_power_plant_3d_model.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://gefuxexo.epizy.com/vorujogikizabede.pdf
    • https://s3.amazonaws.com/vovuzize/is_there_a_power_book_2.pdf
    • https://s3.amazonaws.com/dupula/70038692491.pdf
    • https://s3.amazonaws.com/regovadeje/soundcraft_ui12_update_instructions.pdf
    • http://folalolitawos.epizy.com/7763397488.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000458a0.bin
ef431451b2a991b0dd5de15e94a1a49f8566875b963dfabb9127ef2f5b35bb61		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x458A0 145296 bytes
font_01_sfnt_off000601b0.bin
ff5643c9563a838b92b2a06721138d7e15b44e164cdd327aa48c5fb74450b3eb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x601B0 5532 bytes
font_02_sfnt_off00061477.bin
ac563f1180543c9f4d9b102108afa0e0941b2fd4f199aa08af3cddd05ca1801a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x61477 2048 bytes
font_03_sfnt_off00061d53.bin
e1dc4746df8d083bfe533e8ef78d462d70c78bd4dd2bebc8558580375b0b5767		 pdf-font-stream PDF embedded font (sfnt) at offset 0x61D53 12284 bytes
font_04_sfnt_off00064781.bin
0459b2fbe40d8bd502f450f73e5c5aa8f224e84e7bc06c73fe69362b7ba169fa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x64781 16688 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.