Malicious PDF — malware analysis report

Static analysis result for SHA-256 a6824693d454822c…

MALICIOUS

PDF

75.9 KB Created: 2021-03-15 18:04:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1fa7f895c1a387fea6fe8540336702de SHA-1: 524888f9c95d41c20d483d6e7097ace705315015 SHA-256: a6824693d454822cc5956c7542cb4c24b223b2a672b96715e0a67e5d333d88c6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URI pointing to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, appears to be a lure, likely intended to trick the user into visiting the external URL for malicious purposes.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=are+the+stars+visible+tonight
    • https://cdn.sqhk.co/mugodetutag/hj1YWBB/business_management_simulation_games_online_free.pdf
    • https://cdn-cms.f-static.net/uploads/4409801/normal_601ceafa851dd.pdf
    • https://static.s123-cdn-static.com/uploads/4420230/normal_5ffa7cbc24bec.pdf
    • https://static.s123-cdn-static.com/uploads/4382961/normal_600870295464d.pdf
    • https://cdn.sqhk.co/xamozafi/ekgiOjg/goxafobojudole.pdf
    • https://static.s123-cdn-static.com/uploads/4370987/normal_5fce60a4ba469.pdf
    • https://static.s123-cdn-static.com/uploads/4478716/normal_5fedc77b19feb.pdf
    • https://cdn-cms.f-static.net/uploads/4461525/normal_604222b889039.pdf
    • https://static.s123-cdn-static.com/uploads/4387918/normal_5fcc559dce597.pdf
    • https://cdn-cms.f-static.net/uploads/4423454/normal_602e71dadebd6.pdf
    • https://cdn.sqhk.co/wezufunin/bha7wxQ/drone_remote_start_install.pdf
    • https://static.s123-cdn-static.com/uploads/4470821/normal_6003254c43582.pdf
    • https://cdn-cms.f-static.net/uploads/4369343/normal_603157f132f27.pdf
    • https://cdn.sqhk.co/gavivevok/GrI30gd/96366070186.pdf
    • https://static.s123-cdn-static.com/uploads/4495264/normal_5ff55bcf2c234.pdf
    • https://cdn-cms.f-static.net/uploads/4385021/normal_6024c575676e5.pdf
    • https://cdn-cms.f-static.net/uploads/4380523/normal_603305d78c4bc.pdf
    • https://cdn-cms.f-static.net/uploads/4448743/normal_601d7b5cdcf2e.pdf
    • https://cdn-cms.f-static.net/uploads/4453108/normal_6010f58a9c5c2.pdf
    • https://cdn-cms.f-static.net/uploads/4374362/normal_604f30fbed2f9.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/mizeteb/xitetozexevurujujubuwijib.pdf
    • https://s3.amazonaws.com/ropuba/97875777488.pdf
    • https://s3.amazonaws.com/suxiweke/limam.pdf
    • https://s3.amazonaws.com/tutasujal/basobulazeresanina.pdf
    • https://s3.amazonaws.com/satuja/escmid_guidelines_bacterial_meningitis.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ebc8.bin
eb2f3b61f4885d7f66be03e1ee8c0482c1bfb354e9a139c45fd830c2305c20f8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEBC8 5136 bytes
font_01_sfnt_off0000fd47.bin
eb9ba3ec4674aaa5fe493067a8272c1e4b7e8b64118005406d19bf2e3fe7cc11		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD47 10752 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.