Malicious PDF — malware analysis report

Static analysis result for SHA-256 ab8d37eed03c487a…

MALICIOUS

PDF

572.7 KB Created: 2021-05-14 09:50:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: 78dfe0b31f640da601692297aaa2d7e6 SHA-1: 9db52b1539980ea05b5ff9e629edf38063ae6a29 SHA-256: ab8d37eed03c487a37195c119c3a6b348486b43be12ab2957ac31b65e8a9501b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a suspicious domain, likely for phishing purposes. ClamAV detection as 'Pdf.Phishing.Trojan' further supports its malicious nature. The document body, though heavily obfuscated, contains references to 'The golfing machine 3 imperatives' and the wkhtmltopdf application, suggesting a lure to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5897

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/strik?utm_term=the+golfing+machine+3+imperatives PDF link annotation
    • http://xamibava.22web.org/xaxonebekezo.pdfIn PDF document text
    • http://brightshopbg.xyz/wilol3d44w.pdfIn PDF document text
    • http://kemedejovon.getenjoyment.net/basic_english_grammar_questions_and_answers.pdfIn PDF document text
    • https://cdn.sqhk.co/fusajovogi/b1iaigF/22781248598.pdfIn PDF document text
    • https://cdn.sqhk.co/kuzaxepigi/j1hiM2Y/archie_jumbo_comics.pdfIn PDF document text
    • https://ferizovewop.weebly.com/uploads/1/3/4/8/134887996/wusifof.pdfIn PDF document text
    • http://nunovoxiwanafuz.getenjoyment.net/types_of_drug_addiction.pdfIn PDF document text
    • http://fortysgjdk.fun/mulorfbfeb.pdfIn PDF document text
    • http://nitesufi.sportsontheweb.net/how_many_octaves_is_the_average_vocal_range.pdfIn PDF document text
    • https://cdn.sqhk.co/fogobewataja/zBhajjd/project_management_software_for_mac_free.pdfIn PDF document text
    • https://vavozeja.weebly.com/uploads/1/3/5/3/135308761/77f1d.pdfIn PDF document text
    • http://alisaborodaenko.design/portugal_the_man_woodstock_albumrcc04.pdfIn PDF document text
    • http://rollernefritmassage.xyz/28376676711r359g.pdfIn PDF document text
    • http://dobomasinuraz.iblogger.org/executive_summary_of_a_consulting_report.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://piduvazudofem.epizy.com/google_calendar_app.pdfIn PDF document text
    • https://73a1781f-5c9f-4c76-8a11-a8e8c44f336a.filesusr.com/ugd/d9f7b5_e1c01ad06dbc45a5aa978a30af0d7a99.pdf?index=trueIn PDF document text
    • https://f8b2de7a-6012-4721-b8f1-df5267d6bb95.filesusr.com/ugd/8ebb60_625bbd33f2304b718f3882dd7f70c0f4.pdf?index=trueIn PDF document text
    • https://ed457e25-7262-4bf7-b769-9a3df1da8a49.filesusr.com/ugd/60ac0c_025404a0612a49f2b6d6e215a0a1d17e.pdf?index=trueIn PDF document text
    • https://e6f9d1db-9bad-45ba-a188-0e8e378e8087.filesusr.com/ugd/99b222_4dd7ee0fd1ae4b07a20129ba5ff3c801.pdf?index=trueIn PDF document text
    • https://3f46bf15-0a8c-4e80-b3e5-a2e3bf90e008.filesusr.com/ugd/8e6e76_2620abe05587403481b0d004c34cb05a.pdf?index=trueIn PDF document text
    • http://wilazetifoka.epizy.com/goxogivezile.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0008973a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8973A 5392 bytes
SHA-256: e8cf11ae48bd53bdaab755c438e7518bdf201c5ac95fee9ccbafee192aecd658
font_01_sfnt_off0008a96c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8A96C 11840 bytes
SHA-256: 8091ed41b89be4dc1cb4cb5a3fede7a7beb2fb32ef47acf0f2d49247164e3597
font_02_sfnt_off0008d069.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8D069 4324 bytes
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333

Open this report in the interactive analyzer, or submit your own file for analysis.