Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad323cdb1895f8ba…

MALICIOUS

PDF

69.3 KB Created: 2021-04-01 23:13:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 55e6c2bb4f7f0b11bdab18d4dfd2d02b SHA-1: 946e37d22e5dbd7bd769a126db1511d278140919 SHA-256: ad323cdb1895f8ba103293b40b0cda9ca7fd0f35ef53e6097b561852f1657464
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as a malicious PDF by ClamAV and an ML classifier. It contains an embedded external URI pointing to 'https://vilenefex.ru/123?utm_term=biriyani+songs+bgm+free', which is a strong indicator of a phishing or malware distribution attempt. The document body appears to be obfuscated or corrupted, but the presence of the malicious URL and the high risk score suggest a clear intent to deceive the user.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/123?utm_term=biriyani+songs+bgm+free
    • https://cdn.sqhk.co/purilusevike/Lyhcwjb/gavogatidezimewukinigogi.pdf
    • http://xijulefabogi.getenjoyment.net/sinejugusadizuxulufe.pdf
    • https://cdn.sqhk.co/dodamewope/jdhiuhc/legendary_mini_warriors_mod_apk_unlimited_money.pdf
    • https://xebutikud.weebly.com/uploads/1/3/0/8/130813588/7864235.pdf
    • https://cdn.sqhk.co/jogekiluse/icjbu99/jetizexofube.pdf
    • https://tijotado.weebly.com/uploads/1/3/1/3/131382447/2e94196ce5f66a4.pdf
    • https://rowevopa.weebly.com/uploads/1/3/1/8/131872281/buwexan_pumibovexosere_loxubeze_mawigoxi.pdf
    • http://paxenazubenib.mygamesonline.org/sujabowe.pdf
    • http://xepewifub.mygamesonline.org/autodesk_3ds_max_tutorials_for_beginners.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/fipijife/jofuradalokojewarebama.pdf
    • https://s3.amazonaws.com/baxekojojexusol/brother_p-touch_1290_label_printer.pdf
    • https://uploads.strikinglycdn.com/files/32859aec-5874-4de2-b5fe-ffd021a7c7c1/steven_bragg_books.pdf
    • https://5b3500e9-40b4-440a-9ada-171ed8bcf4c9.filesusr.com/ugd/7820d0_9bd4d430680f4e6396f65a48ccdcd145.pdf?index=true
    • https://676a7a22-5bec-432e-92e0-9d4a0a27851c.filesusr.com/ugd/a1fb72_a23386023a6348cd9da054896e5cc182.pdf?index=true
    • https://d45380bd-a93d-4ef2-b2bd-4c7806d1f6db.filesusr.com/ugd/5d2cf3_8ec921b1e6524917aca951cb9b6d63cc.pdf?index=true
    • https://684917c6-b594-4497-9ea4-141105166a5b.filesusr.com/ugd/0dc9f5_9f65962735c44161a864420a04c0ea87.pdf?index=true
    • https://s3.amazonaws.com/pibabopuduj/sample_resume_format_for_biotechnology_freshers.pdf
    • http://pigutun.myartsonline.com/lower_back_pain_exercises_aaos.pdf
    • https://s3.amazonaws.com/zoxewudunigus/brevini_gearbox_service_manual.pdf
    • https://uploads.strikinglycdn.com/files/f77a2f98-bffa-4239-adb7-e4c7ff7b16e8/emule_kad_server_list_2020.pdf
    • https://s3.amazonaws.com/sonutopexaramuf/oecd_economic_report_2018.pdf
    • https://uploads.strikinglycdn.com/files/4937e894-3bc3-4eea-9dd9-ff545d591414/how_to_set_up_timer_on_worcester_boiler.pdf
    • https://uploads.strikinglycdn.com/files/d9b0ad84-76ac-4793-a3fb-73fc64c3e283/pink_floyd_the_endless_river_full_album_2014.pdf
    • https://beca70af-11ea-46d2-a649-d7fd44c468ee.filesusr.com/ugd/dd41e2_df17058a90384bb592ef480836a08d61.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d0cf.bin
400a2b83e695893c45880182b5c611493392ff88ab06300b8d775ba9aafd71b0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD0CF 5348 bytes
font_01_sfnt_off0000e2f9.bin
07252e8485e3f023b270e7517bb8168a688b064bd8a243e09f1ed3ed71253a54		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE2F9 10824 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.