Malicious PDF — malware analysis report

Static analysis result for SHA-256 a0c0fc07f19edb4e…

MALICIOUS

PDF

351.8 KB Created: 2021-03-20 10:44:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 829fb7314c25bdabfd08727a9ff1a6f7 SHA-1: 907aade2856f3cd95f1bf4e753bbda935dba2306 SHA-256: a0c0fc07f19edb4e3df64a91667f0c055b3e9a1b8e3fa7c66989b31592d8798e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, with a high risk score. It contains an embedded URI pointing to a suspicious domain, likely intended to host a phishing page or malware. The document body, though heavily obfuscated, contains text related to a "solution key" for a PDF, suggesting a lure to trick users into visiting the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9820

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/award?keyword=le+nouvel+allons+y+1+megold%25C3%25B3kulcs+pdf
    • https://noromilo.weebly.com/uploads/1/3/4/5/134587763/d1ddd201eec55.pdf
    • https://patapirebitogi.weebly.com/uploads/1/3/0/8/130814085/zekebuti.pdf
    • https://rojuligu.weebly.com/uploads/1/3/0/9/130969709/4038030.pdf
    • https://xilamexazoleguj.weebly.com/uploads/1/3/2/6/132695560/gerujuxedi_gusuxoxefaji_fetelaz.pdf
    • https://rigegafotu.weebly.com/uploads/1/3/0/7/130740045/pamuxoxopu_kudubapatudamo.pdf
    • https://kovipokuvukos.weebly.com/uploads/1/3/4/4/134497495/5f06600.pdf
    • https://putumilaw.weebly.com/uploads/1/3/1/3/131380263/kigufigupavi.pdf
    • https://zebakikalelu.weebly.com/uploads/1/3/0/7/130775248/9054127.pdf
    • https://guvoladedesu.weebly.com/uploads/1/3/1/4/131453897/rojin.pdf
    • http://fontawesome.iohttp://fontawesome.io/license/
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/gewisetug/kindle_acepta_formato.pdf
    • https://s3.amazonaws.com/fivebo/bumblebee_transformer_face_mask.pdf
    • https://s3.amazonaws.com/pusolefosex/lukebijuzanuzoxesokumuw.pdf
    • https://97783159-ced7-426e-9fbd-60d2bb3342fb.filesusr.com/ugd/00058f_80f592b1588f4496b89bec1c45681efb.pdf?index=true
    • https://3f9320ff-391d-49df-b192-c557e211a93c.filesusr.com/ugd/469aea_ef8f8401bc074d538a38ccc93f4c2df1.pdf?index=true
    • https://s3.amazonaws.com/pevarijidasalop/dikusivovu.pdf
    • https://s3.amazonaws.com/jizubisetebof/ca_disability_physician_form.pdf
    • https://s3.amazonaws.com/luxaduzimase/sushi_nutritional_information_california_roll.pdf
    • https://s3.amazonaws.com/gopuze/may_2018_sat_answers.pdf
    • https://s3.amazonaws.com/ninazarila/weather_report_for_garden_city_kansas.pdf
    • https://s3.amazonaws.com/firudegix/23282923931.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00052395.bin
1b89cd0a613842fd28fcfc833bdab7ea257a045428400af7a208909e4f7f8713		 pdf-font-stream PDF embedded font (sfnt) at offset 0x52395 1724 bytes
font_01_sfnt_off00052c20.bin
80f635df3467116481b5ceea5f89db731d3dd3ad03aa2cc98ddf469977c40b98		 pdf-font-stream PDF embedded font (sfnt) at offset 0x52C20 5736 bytes
font_02_sfnt_off00053f7d.bin
0c7a50a84590006c72063e5b1a8463500c2b5f1123f89608f18fdda714fbbfbe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x53F7D 16152 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.