Malicious PDF — malware analysis report

Static analysis result for SHA-256 aeb13428718f04c1…

MALICIOUS

PDF

86.0 KB Created: 2021-03-29 12:24:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1f1271ecd8b030389c59bb1bd61f1796 SHA-1: 11ac1b58eed40c8f5dfe53d0ee3233eae2e6da0c SHA-256: aeb13428718f04c106851e3d457cd16588363af5bac1d60be857b1c5361a00b1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains an embedded URL pointing to a suspicious domain, identified by both heuristics and a machine learning classifier as malicious. ClamAV also detected it as a phishing trojan. The presence of an external URI and the ML classification strongly suggest a phishing or malware distribution attempt, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=circle+map+for+defining+in+context
    • https://cdn.sqhk.co/mekaxosur/Lwjfigk/man_talking_to_animals_movie.pdf
    • https://cdn.sqhk.co/nodezaneripe/NidbUgi/fopebixogigo.pdf
    • https://cdn.sqhk.co/bizujutenifo/iZiisgh/wagakejelim.pdf
    • https://cdn-cms.f-static.net/uploads/4469623/normal_60166050d358c.pdf
    • https://cdn.sqhk.co/jorubili/BVIgejb/roterra_flip_the_fairytale.pdf
    • https://cdn.sqhk.co/xedasuzefer/dgjhcjg/color_swap_cool_math_games.pdf
    • https://cdn.sqhk.co/konanetufuda/hgjifie/fun_things_to_do_in_philly_this_week.pdf
    • https://cdn.sqhk.co/sazalevimit/0Jl5J5P/mdacne_anti_acne_mask_review.pdf
    • https://cdn-cms.f-static.net/uploads/4392647/normal_5fd6582dbdd11.pdf
    • https://cdn.sqhk.co/fawabanof/U3BgjsC/unnie_doll_mod_apk_4._5.pdf
    • https://cdn.sqhk.co/kapimetavis/gehbjcT/gifagomewa.pdf
    • https://cdn.sqhk.co/molivovuki/idifqhj/7995172033.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/a7fbffc5-62a0-428d-a306-2a8d2b96d184/21041144179.pdf
    • https://uploads.strikinglycdn.com/files/e4c190cb-9c38-4053-b965-982380e7f65e/system_engineering_verification_methods.pdf
    • https://uploads.strikinglycdn.com/files/7eb22205-4638-43ab-a100-467edd11bdef/make_sentence_with_game_plan.pdf
    • https://uploads.strikinglycdn.com/files/0daebe33-e60a-487a-ad52-6e319516ca20/how_do_you_adjust_a_square_d_well_pressure_switch.pdf
    • https://uploads.strikinglycdn.com/files/8c92a7ac-d71f-44d2-8cb8-ae031987a77b/jafuseroza.pdf
    • https://uploads.strikinglycdn.com/files/a9ce304e-0871-434f-b830-bca0c205a9c9/xamewuko.pdf
    • https://uploads.strikinglycdn.com/files/0c2d7036-4d06-4326-934e-6110e4b8b520/nokofal.pdf
    • https://uploads.strikinglycdn.com/files/6f5b6583-03f5-4acc-a50e-7b410048acdf/interpreter_of_maladies_quotes_shmoop.pdf
    • https://uploads.strikinglycdn.com/files/23f7e939-44ab-4b7e-8234-a51a74ae2c6b/fezovatexumivajujib.pdf
    • https://uploads.strikinglycdn.com/files/b72bb489-cb51-40b6-95d1-7afdb836cc94/12875188172.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f235.bin
78efc9e8242a1ae611e9e58fe959f05380bc1e669f3561c592de552a87befa6a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF235 5220 bytes
font_01_sfnt_off0001044c.bin
d91293280f3af792944da8ea4a29f726a227ec63c21985d7a16233135ad38f20		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1044C 5176 bytes
font_02_sfnt_off000115cd.bin
a8ee8aae40e1591ee2fbcc56aabf5bbef92d985d1ecf34d4f4fd6392890e5019		 pdf-font-stream PDF embedded font (sfnt) at offset 0x115CD 11372 bytes
font_03_sfnt_off00013bce.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13BCE 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.