Malicious PDF — malware analysis report

Static analysis result for SHA-256 a7dc85443c621e6f…

MALICIOUS

PDF

109.5 KB Created: 2021-03-14 15:09:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a183f6e0523acc7e0d883757aa2e9a49 SHA-1: d1a8da150e20dc6d32a8fd58d64f4f2c70c71383 SHA-256: a7dc85443c621e6fc1e626c35b1be4fbe2bd2aceee6bee0e55a69657f9d35a6d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, identified as malicious by ClamAV and ML classifiers. The document body, though heavily obfuscated, suggests a lure related to a 'guide'. The presence of external URIs indicates an attempt to redirect the user to a malicious site, likely for phishing or to download further payloads. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/wix?keyword=the+molten+front+offensive+guide
    • http://fartook.online/752557478896gcxk.pdf
    • http://bupetud.xyz/how_to_block_calls_on_my_panasonic_phone5awpf.pdf
    • https://kifakofaw.weebly.com/uploads/1/3/4/0/134016777/8247183.pdf
    • http://interstart.online/54456610231yczuo.pdf
    • https://cdn.sqhk.co/pumafuki/ojhhajh/field_marketing_manager_salary_san_francisco.pdf
    • https://cdn.sqhk.co/jezaziritav/XX8egf8/german_truck_simulator_2010_mod.pdf
    • https://jubiporosevuzu.weebly.com/uploads/1/3/2/6/132695682/80dfcb5a98afc1.pdf
    • http://stylecurtains.com/science_of_creature_designndpre.pdf
    • https://ligofaxudatejot.weebly.com/uploads/1/3/0/7/130739538/botodi.pdf
    • https://cdn.sqhk.co/vutenugade/Itbieja/sbi_card_statement.pdf
    • http://glawerry.online/32963988555sj4hp.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/bba11601-40ff-4e44-9dff-10fe60c3fd5f/how_to_use_a_trilogy_ventilator.pdf
    • http://jefesati.rf.gd/best_animation_software_for_windows_10_free_download.pdf
    • http://dokewisikod.rf.gd/modern_alphabet_font_overlap_style_free.pdf
    • https://uploads.strikinglycdn.com/files/a418cfd8-c069-4210-91f3-8d6ab9c628ad/pesuta.pdf
    • https://uploads.strikinglycdn.com/files/a99d4ee2-a291-4616-8b4e-c03108129cd6/louisiana_private_investigator_requirements.pdf
    • https://f38be386-5799-403b-9303-fb121113655a.filesusr.com/ugd/6f1aa7_07e5814a25f4479597e38b5a80c7ac7d.pdf?index=true
    • http://jagofebasej.epizy.com/99649495167.pdf
    • https://52c77544-2eb8-427c-ad0e-a8a7e2ea9366.filesusr.com/ugd/93288f_d55b4fbb3ca54110b2e04cda1c7120fc.pdf?index=true
    • https://4694dce0-4d1e-4c77-b4da-d1f025f82355.filesusr.com/ugd/fb332b_d84b347040214e50853794a5691e0175.pdf?index=true
    • https://e82ff0bd-cb1a-4782-8b92-0a0fb7657660.filesusr.com/ugd/d17951_a62d38c6ccc2452b9668be63b039b6f7.pdf?index=true
    • http://xokeraje.rf.gd/dota_2_tinker_guide.pdf
    • http://zadabodemuliju.epizy.com/fda_guideline_atopic_dermatitis.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00017223.bin
2a6359fe4e2e314ae17cb1b74623f5f4a5d9bdc837c2b8b8798deb3c284df85f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17223 5120 bytes
font_01_sfnt_off0001836d.bin
13ebc3dff0341b3a8ceb150294c6a84269f9d9e7bb4f3b1a64b1f28f989b4786		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1836D 10876 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.