Malicious PDF — malware analysis report

Static analysis result for SHA-256 b0b54a60b979b194…

MALICIOUS

PDF

67.3 KB Created: 2020-12-15 00:34:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: 9a5b714c2a2effcebb9fcc3e6c99fd04 SHA-1: e9644ffa49fbbb7854c0653918c9f6f90b92b23f SHA-256: b0b54a60b979b19485af43aeb7d5b6065c10fcb46c8ef08d8ce0c24a3173243c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL, identified as malicious by ClamAV and ML classifiers. The document body, though heavily obfuscated, suggests a lure related to a 'system diagram'. The primary IOC is the malicious URL, which is likely intended to lead the user to a phishing or malware download site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/strik?utm_term=ebb+and+flow+system+diagram PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4413000/normal_5fbf5f3a4c131.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4401694/normal_5f9a77a627465.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4365613/normal_5fc5bffcc5caf.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc33b91b8467722f1e32cd3/t/5fd1332a11bfcc640578e713/1607545644425/kofudijexilalojonisav.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0f6c4e5c7695ca99bf722/t/5fc716b809f4d56e8f7d76f2/1606883001134/jefowiperilibazopikutisi.pdfIn PDF document text
    • https://s3.amazonaws.com/nisoxow/33904937872.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe0fcd3c02f22b9dd4ea84/1606291408313/78799004529.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc2b0d2239b0722913ccfbe/t/5fc3b691cb3e0f5771c157a1/1606661781584/4364740180.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc6cffba4d75e5252f0b0fb/t/5fca31e42f5dbb44b78601ce/1607086564975/36216245395.pdfIn PDF document text
    • https://s3.amazonaws.com/winumigutam/southern_cricket_frog.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5a84892c50b1a1e97e4fb/t/5fd08eb5b8bf0379e60d74dc/1607503542248/sharpener_pencil_metal_double_hole.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0cf44e5c7695ca99b2c1d/t/5fc81ffae21c7c679ad78ded/1606950906686/world_builder_farm_craft_mod_apk.pdfIn PDF document text
    • https://s3.amazonaws.com/vapite/9553720917.pdfIn PDF document text
    • https://s3.amazonaws.com/magapeguwabe/64166199915.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c9b8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC9B8 5516 bytes
SHA-256: a9f98ac387f79537230787b775867003aaa3a747b369594e5949d364d2f87704
font_01_sfnt_off0000dc84.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDC84 10496 bytes
SHA-256: 2030240821a4aa6c7291db5b08adec1b0a6470cc529aa3d0864b09ce76df12b0

Open this report in the interactive analyzer, or submit your own file for analysis.