Malicious PDF — malware analysis report

Static analysis result for SHA-256 adab9ee6a666f470…

MALICIOUS

PDF

94.6 KB Created: 2021-04-15 16:48:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6b4835807c3e37d367b9899786f921ef SHA-1: 92a25b2ff4eada9c6626ae6058a30848e26910d2 SHA-256: adab9ee6a666f470fe28a37d05ea746de10e6b3b87f243cfefbadba641b79171
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and an ML classifier indicated a high probability of maliciousness. The embedded URL `https://midufefew.ru/strik?utm_term=descartes+error+book+summary` suggests a phishing or credential harvesting attempt, likely disguised as a document summary. No scripts were extracted, but the PDF structure itself contains malicious indicators.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/strik?utm_term=descartes+error+book+summary
    • http://zijukikov.mypressonline.com/bsc_mathematics_notes.pdf
    • https://cdn.sqhk.co/fasazani/XhgjMhg/61725331292.pdf
    • http://raisinshq.pro/how_thick_is_the_suns_atmosphereeddbk.pdf
    • http://sivelural.mygamesonline.org/10861161371.pdf
    • http://fixmarker.fun/53140432946p5404.pdf
    • http://creditactive.info/lg_v30_stuck_on_verizon_screennmm3y.pdf
    • https://cdn.sqhk.co/simikitivo/tjjdgeU/98864153197.pdf
    • https://cdn.sqhk.co/zebimapajod/ejdiegh/runidewerisafa.pdf
    • http://1yamal.space/paul_emmerson_business_english_handbook_advancedyk8q7.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/a80d8211-4b30-4a84-aa81-a16179860b13/matanexetiwezad.pdf
    • https://s3.amazonaws.com/farokof/9128062672.pdf
    • https://uploads.strikinglycdn.com/files/641e4fea-1356-4c9e-b71a-c92cd4449eb9/gusisikimanaxiduwukanegir.pdf
    • https://s3.amazonaws.com/rovuweraja/teoria_general_de_los_titulos_de_credito_en_guatemala.pdf
    • https://s3.amazonaws.com/tejuvonixag/sukugokodef.pdf
    • https://uploads.strikinglycdn.com/files/e37398c0-46f2-4367-a587-4fe5a2f6ca97/gixenewibupuximod.pdf
    • https://s3.amazonaws.com/jutenojamega/vitoxo.pdf
    • http://godosuluto.myartsonline.com/oracle_sql_interview_questions_for_freshers.pdf
    • https://uploads.strikinglycdn.com/files/9b10b385-1987-48a8-8678-57b9ab6d8161/texarula.pdf
    • https://s3.amazonaws.com/vuliwisuwig/who_gmp_guidelines_for_sterile_pharmaceutical_products.pdf
    • https://uploads.strikinglycdn.com/files/8669aca2-4ef5-42ae-9708-16d6091fe1e3/how_much_do_vet_tech_specialist_make.pdf
    • https://uploads.strikinglycdn.com/files/0f7342ce-68db-4828-a088-2a9e08d70be9/2858268120.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012100.bin
5ac8bfe5c4847287bac152fc6a77225832dd1668a1575d39771f2824405e048f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12100 5220 bytes
font_01_sfnt_off000132bf.bin
c9743212e720c5f6f9dc18a9cf54188755defe2e0a4b00d54e402c05048857ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0x132BF 10848 bytes
font_02_sfnt_off000157c0.bin
c988415812f594187b0a0ed75dc52802e798e1695b49bd300f8412a65040a449		 pdf-font-stream PDF embedded font (sfnt) at offset 0x157C0 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.