Malicious PDF — malware analysis report

Static analysis result for SHA-256 a42ec9ff467a4dcc…

MALICIOUS

PDF

99.9 KB Created: 2021-03-22 23:55:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a4c077d9f055825a9bfd17432905f632 SHA-1: 216ef7392691914b90f15785c9386281d504c44b SHA-256: a42ec9ff467a4dcc992821148b0712b7a3530306804add978e79f58dc81d84ed
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL pointing to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also strongly flagged this PDF as malicious. The embedded URL is likely intended to redirect the user to a phishing site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=yoga+mudras+pdf+in+kannada
    • https://cdn-cms.f-static.net/uploads/4382952/normal_600dd90e204e9.pdf
    • https://cdn-cms.f-static.net/uploads/4417032/normal_60116ac82f69d.pdf
    • http://fedorahosted.org/lohit
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/bc83e865-03a4-4db1-90ee-5a46d7e336ba/wapupibolimogasole.pdf
    • https://s3.amazonaws.com/kukazowox/99365794335.pdf
    • http://kulebosux.myartsonline.com/senonukoguziwepizalokemex.pdf
    • https://s3.amazonaws.com/duzexefemosaxe/ubuntu_14._04_kambing.pdf
    • https://uploads.strikinglycdn.com/files/28fbb0ba-f8f5-4416-afc5-1b2963f8613a/sony_str-dh520_7.1_surround_receiver.pdf
    • https://uploads.strikinglycdn.com/files/61c9a8a9-bd54-4d77-b781-caeb507925fb/24697223241.pdf
    • https://s3.amazonaws.com/gateme/nelson_math_textbook_grade_10_answers.pdf
    • https://s3.amazonaws.com/wolawatin/wifoxazenidax.pdf
    • https://s3.amazonaws.com/fadadedezeker/androidx._appcompat._app._appcompatactivity_not_found.pdf
    • http://kozogasivufi.myartsonline.com/52853581082.pdf
    • https://uploads.strikinglycdn.com/files/9fa00937-b0d5-4718-9b54-51aba0c3b977/best_neve_1073_clone.pdf
    • https://uploads.strikinglycdn.com/files/a6978157-f6e4-408f-ac35-ff7aecc9dc7d/how_to_make_google_cardboard_vr_headset.pdf
    • https://uploads.strikinglycdn.com/files/90fb16d5-12db-43f5-ae84-b2f510263c5c/88900815484.pdf
    • https://uploads.strikinglycdn.com/files/d7a7f18d-17cf-445f-8bf0-1b994264cb8d/bram_stokers_dracula_full_movie.pdf
    • https://uploads.strikinglycdn.com/files/10465dfb-c4d4-4639-bb65-c631a5d7976c/mivekam.pdf
    • http://gotimovogeminir.myartsonline.com/apush_period_1_notes.pdf
    • https://uploads.strikinglycdn.com/files/608358d6-7565-453d-9aeb-58fe09fda135/pemupelu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000111f3.bin
22ac736fa8126a8c3e49364bb4d5f7b3ff749d860e58906d4480134e7d0c3503		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x111F3 46536 bytes
font_00_sfnt_off0000ffce.bin
f4a21044123abcd655691c8b16f3abc2729ec7b84391d8cc13da3b662f808ef7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFFCE 5352 bytes
font_02_sfnt_off00015f74.bin
7e017b9836bfb466134d772e94685141fda52a65eaaa1d71833f90ecf15707a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15F74 9484 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.