Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa3694b51372e182…

MALICIOUS

PDF

76.7 KB Created: 2021-04-06 05:15:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 550e4217053021448948f66a58b01661 SHA-1: 924962dd2209ade0fc4f46eba8eca836cbecef28 SHA-256: aa3694b51372e1829003f8a1573590156eb5b3198c9cc70976566f6d6ede75df
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains embedded URLs, one of which is used as a lure for a search query. The ML classifier and ClamAV detection strongly indicate maliciousness. The presence of multiple unknown reputation URLs suggests a phishing or malware distribution attempt, likely involving the download of a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=symcode+bluetooth+barcode+scanner+manual
    • https://vedakevuvapi.weebly.com/uploads/1/3/4/0/134013486/jotafuji.pdf
    • http://nufivuzelikonax.getenjoyment.net/important_synonyms_and_antonyms_for_ssc_stenographer.pdf
    • http://vinnipoh.fun/3206064373954hhe.pdf
    • https://static.s123-cdn-static.com/uploads/4385848/normal_5ff221ad52b9c.pdf
    • https://cdn-cms.f-static.net/uploads/4445739/normal_604cfbcd18f8e.pdf
    • http://kojibataruv.iblogger.org/english_vocabulary_with_example_sentences.pdf
    • http://nafewid.sportsontheweb.net/pdf_page_splitter_download_free.pdf
    • http://zujewubowufonug.scienceontheweb.net/aerospike_database_a_complete_guide.pdf
    • https://tezifotunojoke.weebly.com/uploads/1/3/0/7/130776805/xadididisesarag-duwatatiwumot-pejogazabuko.pdf
    • https://cdn-cms.f-static.net/uploads/4416131/normal_600c06b969d89.pdf
    • https://julalawigito.weebly.com/uploads/1/3/4/8/134869680/25ec5829.pdf
    • http://giviwopifa.22web.org/sinidado.pdf
    • http://wuwudikosegukem.mypressonline.com/bogatulezirerume.pdf
    • https://cdn-cms.f-static.net/uploads/4377095/normal_6041a822d8acf.pdf
    • https://finedogu.weebly.com/uploads/1/3/4/7/134749629/lemade.pdf
    • http://kiteleminokovi.22web.org/degonozitalaku.pdf
    • https://cdn-cms.f-static.net/uploads/4445130/normal_6026eec5dfa64.pdf
    • http://copyright-help-report.com/boy_scout_committee_meeting_agenda88ala.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/510a817e-d51d-4148-b17e-bd4598a8fe0b/how_much_time_it_takes_to_learn_ios_app_development.pdf
    • http://katasekut.epizy.com/solidworks_practice_exam.pdf
    • https://uploads.strikinglycdn.com/files/403182e2-c40f-400b-a8d2-2f6c6c1c3a6f/the_trial_and_death_of_socrates_by_plato.pdf
    • http://lepajavawis.epizy.com/lab_assistant_2020_answer_key_download.pdf
    • https://uploads.strikinglycdn.com/files/c93981d3-0bca-424c-a051-e3be1de6bff9/sword_art_online_vr_gameplay.pdf
    • http://wenares.myartsonline.com/dibujo_del_cuerpo_humano_y_sus_partes_en_ingls.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000edf6.bin
33395e6b6a346983cf1d2160172bc04fcc8469dcaaa188d1f12bb1007c85ffb4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEDF6 5524 bytes
font_01_sfnt_off00010094.bin
72b2b1afb5d3f45adbf70a85bd8d9870dc57850bca6d4958c55baddf5de9d95b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10094 10696 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.