Malicious PDF — malware analysis report

Static analysis result for SHA-256 a1e1dcebe2378e52…

MALICIOUS

PDF

149.0 KB Created: 2021-03-14 22:18:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-17
MD5: 307890627a2e9f1c9ae39508e2e1a023 SHA-1: ab523a798c3f55ac1a8ac18d5d51b38292d14bd9 SHA-256: a1e1dcebe2378e52b961c6bea363ec6d8ebc39e87c25f182e54f9e88b87bc090
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, appears to reference search terms related to software downloads, suggesting a phishing or malware distribution lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9973

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=qq+music+apk+2019 PDF link annotation
    • http://businessmentality.com/samavb0z3t.pdfIn PDF document text
    • http://ionatr.space/ammonia_in_wastewateruk0l0.pdfIn PDF document text
    • http://pl50off.info/bimotozapusisizone3bbvz.pdfIn PDF document text
    • http://hargotel.xyz/quality_management_system_software_food_industrykq3lm.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/purixifusipelid/90263679976.pdfIn PDF document text
    • https://s3.amazonaws.com/mikibetiv/xixabazujekojojefuragoti.pdfIn PDF document text
    • https://s3.amazonaws.com/wiremeresegikon/gefivowedoxunudevofaje.pdfIn PDF document text
    • https://s3.amazonaws.com/suzixegazunow/cmo_se_dice_cartel_informativo_en_ingls.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ea924007-a94b-4a14-a4a3-f654fdcf19ff/what_type_of_plate_boundary_does_seafloor_spreading_occur_along.pdfIn PDF document text
    • https://s3.amazonaws.com/pusolefosex/booker_t_washington_facts_information.pdfIn PDF document text
    • https://s3.amazonaws.com/gezetega/mutually_exclusive_collectively_exhaustive.pdfIn PDF document text
    • https://s3.amazonaws.com/sagotomagin/bike_race_full_mod_apk.pdfIn PDF document text
    • https://s3.amazonaws.com/bokexizometun/fraction_to_decimal_to_percentage_worksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/varolexexus/workforce_capacity_planning_template.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1d0a0fad-7aae-471f-a2e8-6b0b59453856/skyrim_se_how_to_install_skyui.pdfIn PDF document text
    • https://s3.amazonaws.com/goviwigax/45530057594.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c37bc8c4-1aab-46b1-9ba4-b7563de45028/43647231086.pdfIn PDF document text
    • https://s3.amazonaws.com/tuzakifezara/marriage_invitation_letter_template.pdfIn PDF document text
    • https://s3.amazonaws.com/gidibesuxi/19038177118.pdfIn PDF document text
    • https://s3.amazonaws.com/jitimesolagun/bandit_queen_full_movie_in_480p.pdfIn PDF document text
    • https://s3.amazonaws.com/bepukuba/32146939806.pdfIn PDF document text
    • https://s3.amazonaws.com/lonozote/tenibasuzutomax.pdfIn PDF document text
    • https://s3.amazonaws.com/sixenogafopoj/19791738969.pdfIn PDF document text
    • https://s3.amazonaws.com/fujadabez/wigagebexise.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eee9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEEE9 88988 bytes
SHA-256: 8f0e9188855bf9bd9886d4b58e16deb5cf08b17f3dc9a00be17fef68c6604a42
font_01_sfnt_off0001f677.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1F677 5684 bytes
SHA-256: d4b6f5f58245b6a5d3fbd9be6479314540444fdc903a312b7a9cb1a0a23ce869
font_02_sfnt_off000209d2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x209D2 10944 bytes
SHA-256: 29e4d4490fd0eb233ea000aef71466caf79e7a5ddbf883500eb115a5ead115b9
font_03_sfnt_off00022f53.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x22F53 16092 bytes
SHA-256: 9af6fc3bf9d751f70540aea0fa47faa159a3604992cda23d2adcda3ffc5346b2

Open this report in the interactive analyzer, or submit your own file for analysis.